From 5b8d0011b3c0757f2a882561d76a0b1331525e7d Mon Sep 17 00:00:00 2001 From: kato Date: Thu, 5 Dec 2024 17:14:23 +0900 Subject: [PATCH 1/2] =?UTF-8?q?fix=20#4067=20Cookie=EF=BC=88csrfToken?= =?UTF-8?q?=EF=BC=89=E3=81=ABsecure=E5=B1=9E=E6=80=A7=E3=81=8C=E4=BB=98?= =?UTF-8?q?=E3=81=8B=E3=81=AA=E3=81=84=E5=95=8F=E9=A1=8C=E3=82=92=E8=A7=A3?= =?UTF-8?q?=E6=B1=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/Application.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/Application.php b/src/Application.php index c4a2b3fa6b..af06a1976e 100644 --- a/src/Application.php +++ b/src/Application.php @@ -64,6 +64,12 @@ public function bootstrap(): void */ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue { + $csrfProtectionMiddlewareOptions = ['httponly' => true]; + //リクエストがhttpsならcsrfTokenにもsecureヘッダを付与 + $sessionConfig = (array)Configure::read('Session'); + if (!empty($sessionConfig['ini']['session.cookie_secure']) || ini_get('session.cookie_secure') == 1) { + $csrfProtectionMiddlewareOptions['secure'] = true; + } $middlewareQueue // Catch any exceptions in the lower layers, // and make an error page/response @@ -87,9 +93,7 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue // Cross Site Request Forgery (CSRF) Protection Middleware // https://book.cakephp.org/5/en/security/csrf.html#cross-site-request-forgery-csrf-middleware - ->add(new CsrfProtectionMiddleware([ - 'httponly' => true, - ])); + ->add(new CsrfProtectionMiddleware($csrfProtectionMiddlewareOptions)); return $middlewareQueue; } From 5b0b57fe2c7eba0dc3a1ff738a335124742a2de9 Mon Sep 17 00:00:00 2001 From: ryuring Date: Fri, 6 Dec 2024 12:38:46 +0900 Subject: [PATCH 2/2] Update Application.php --- src/Application.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Application.php b/src/Application.php index af06a1976e..5415ec0658 100644 --- a/src/Application.php +++ b/src/Application.php @@ -66,8 +66,8 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue { $csrfProtectionMiddlewareOptions = ['httponly' => true]; //リクエストがhttpsならcsrfTokenにもsecureヘッダを付与 - $sessionConfig = (array)Configure::read('Session'); - if (!empty($sessionConfig['ini']['session.cookie_secure']) || ini_get('session.cookie_secure') == 1) { + $sessionConfig = (array) Configure::read('Session'); + if (!empty($sessionConfig['ini']['session.cookie_secure']) || (int) ini_get('session.cookie_secure') === 1) { $csrfProtectionMiddlewareOptions['secure'] = true; } $middlewareQueue