Skip to content

Commit 128c2ad

Browse files
dhorytskyidhorytskyi
authored
Merge pull request #4874 from magento-mpi/MAGETWO-99161
MAGETWO-99161: Frontend cookies are not set with secure flag on https
2 parents 55519da + 5eaed4e commit 128c2ad

File tree

7 files changed

+170
-4
lines changed

7 files changed

+170
-4
lines changed

Diff for: ‎app/code/Magento/Cookie/Block/DataProviders/SessionConfig.php

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\Cookie\Block\DataProviders;
9+
10+
use Magento\Framework\Session\Config\ConfigInterface;
11+
use Magento\Framework\View\Element\Block\ArgumentInterface;
12+
13+
/**
14+
* Provide cookie configuration
15+
*/
16+
class SessionConfig implements ArgumentInterface
17+
{
18+
/**
19+
* Session config
20+
*
21+
* @var ConfigInterface
22+
*/
23+
private $sessionConfig;
24+
25+
/**
26+
* Constructor
27+
*
28+
* @param ConfigInterface $sessionConfig
29+
*/
30+
public function __construct(
31+
ConfigInterface $sessionConfig
32+
) {
33+
$this->sessionConfig = $sessionConfig;
34+
}
35+
/**
36+
* Get session.cookie_secure
37+
*
38+
* @return bool
39+
* @SuppressWarnings(PHPMD.BooleanGetMethodName)
40+
*/
41+
public function getCookieSecure()
42+
{
43+
return $this->sessionConfig->getCookieSecure();
44+
}
45+
}

Diff for: ‎app/code/Magento/Cookie/view/adminhtml/layout/default.xml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
9+
<body>
10+
<referenceContainer name="after.body.start">
11+
<block class="Magento\Framework\View\Element\Js\Cookie" name="cookie_config" template="Magento_Cookie::html/cookie.phtml">
12+
<arguments>
13+
<argument name="session_config" xsi:type="object">Magento\Cookie\Block\DataProviders\SessionConfig</argument>
14+
</arguments>
15+
</block>
16+
</referenceContainer>
17+
</body>
18+
</page>

Diff for: ‎app/code/Magento/Cookie/view/base/requirejs-config.js

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
/**
2+
* Copyright © Magento, Inc. All rights reserved.
3+
* See COPYING.txt for license details.
4+
*/
5+
6+
var config = {
7+
paths: {
8+
'jquery/jquery-storageapi': 'Magento_Cookie/js/jquery.storageapi.extended'
9+
}
10+
};

Diff for: ‎app/code/Magento/Cookie/view/base/templates/html/cookie.phtml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
/**
8+
* Cookie settings initialization script
9+
*
10+
* @var $block \Magento\Framework\View\Element\Js\Cookie
11+
*/
12+
?>
13+
14+
<script>
15+
window.cookiesConfig = window.cookiesConfig || {};
16+
window.cookiesConfig.secure = <?= /* @noEscape */ $block->getSessionConfig()->getCookieSecure() ? 'true' : 'false' ?>;
17+
</script>

Diff for: ‎app/code/Magento/Cookie/view/base/web/js/jquery.storageapi.extended.js

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
/**
2+
* Copyright © Magento, Inc. All rights reserved.
3+
* See COPYING.txt for license details.
4+
*/
5+
6+
define([
7+
'jquery',
8+
'jquery/jquery.cookie',
9+
'jquery/jquery.storageapi.min'
10+
], function ($) {
11+
'use strict';
12+
13+
/**
14+
*
15+
* @param {Object} storage
16+
* @private
17+
*/
18+
function _extend(storage) {
19+
$.extend(storage, {
20+
_secure: window.cookiesConfig ? window.cookiesConfig.secure : false,
21+
22+
/**
23+
* Set value under name
24+
* @param {String} name
25+
* @param {String} value
26+
* @param {Object} [options]
27+
*/
28+
setItem: function (name, value, options) {
29+
var _default = {
30+
expires: this._expires,
31+
path: this._path,
32+
domain: this._domain,
33+
secure: this._secure
34+
};
35+
36+
$.cookie(this._prefix + name, value, $.extend(_default, options || {}));
37+
},
38+
39+
/**
40+
* Set default options
41+
* @param {Object} c
42+
* @returns {storage}
43+
*/
44+
setConf: function (c) {
45+
if (c.path) {
46+
this._path = c.path;
47+
}
48+
49+
if (c.domain) {
50+
this._domain = c.domain;
51+
}
52+
53+
if (c.expires) {
54+
this._expires = c.expires;
55+
}
56+
57+
if (typeof c.secure !== 'undefined') {
58+
this._secure = c.secure;
59+
}
60+
61+
return this;
62+
}
63+
});
64+
}
65+
66+
if (window.cookieStorage) {
67+
_extend(window.cookieStorage);
68+
}
69+
});

Diff for: ‎app/code/Magento/Cookie/view/frontend/layout/default.xml

+5
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@
99
<body>
1010
<referenceContainer name="after.body.start">
1111
<block class="Magento\Cookie\Block\Html\Notices" name="cookie_notices" template="Magento_Cookie::html/notices.phtml"/>
12+
<block class="Magento\Framework\View\Element\Js\Cookie" name="cookie_config" template="Magento_Cookie::html/cookie.phtml">
13+
<arguments>
14+
<argument name="session_config" xsi:type="object">Magento\Cookie\Block\DataProviders\SessionConfig</argument>
15+
</arguments>
16+
</block>
1217
</referenceContainer>
1318
</body>
1419
</page>

Diff for: ‎app/code/Magento/PageCache/Plugin/RegisterFormKeyFromCookie.php

+6-4
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,10 @@
1010
namespace Magento\PageCache\Plugin;
1111

1212
use Magento\Framework\App\PageCache\FormKey as CacheFormKey;
13-
use Magento\Framework\Escaper;
1413
use Magento\Framework\Data\Form\FormKey;
15-
use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
14+
use Magento\Framework\Escaper;
1615
use Magento\Framework\Session\Config\ConfigInterface;
16+
use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
1717

1818
/**
1919
* Allow for registration of a form key through cookies.
@@ -46,7 +46,7 @@ class RegisterFormKeyFromCookie
4646
private $sessionConfig;
4747

4848
/**
49-
* @param CacheFormKey $formKey
49+
* @param CacheFormKey $cacheFormKey
5050
* @param Escaper $escaper
5151
* @param FormKey $formKey
5252
* @param CookieMetadataFactory $cookieMetadataFactory
@@ -70,7 +70,6 @@ public function __construct(
7070
* Set form key from the cookie.
7171
*
7272
* @return void
73-
*
7473
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
7574
*/
7675
public function beforeDispatch(): void
@@ -85,6 +84,8 @@ public function beforeDispatch(): void
8584
}
8685

8786
/**
87+
* Set form key cookie
88+
*
8889
* @param string $formKey
8990
* @return void
9091
*/
@@ -94,6 +95,7 @@ private function updateCookieFormKey(string $formKey): void
9495
->createPublicCookieMetadata();
9596
$cookieMetadata->setDomain($this->sessionConfig->getCookieDomain());
9697
$cookieMetadata->setPath($this->sessionConfig->getCookiePath());
98+
$cookieMetadata->setSecure($this->sessionConfig->getCookieSecure());
9799
$lifetime = $this->sessionConfig->getCookieLifetime();
98100
if ($lifetime !== 0) {
99101
$cookieMetadata->setDuration($lifetime);

0 commit comments

Comments
 (0)