`true` isn't a good option - it should accept only the defined values from the RFC (https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-3.1), i.e. `Strict` or `Lax`.

Bug for adding INI session.cookie_samesite: https://bugs.php.net/bug.php?id=73454

I've created a patch that adds support for the SameSite cookie attribute in the setcookie() function.

The samesite value can be set like this through setcookie(), note that the last function argument is the samesite value ("Lax" in this case):

<?php setcookie("TestCookie", 31337, time()+3600, "/", "thisdomain.com", 1, 1, "Lax" ); ?>

Retrieving the headers shows the SameSite=Lax cookie attribute being set:

$ curl -I http://X.X.X.X/index.php
HTTP/1.1 200 OK
Date: Thu, 01 Dec 2016 10:06:55 GMT
Server: Apache/2.4.6 (CentOS) PHP/7.0.13 OpenSSL/1.0.1e-fips
X-Powered-By: PHP/7.0.13
Set-Cookie: TestCookie=31337; expires=Thu, 01-Dec-2016 11:06:55 GMT; Max-Age=3600; path=/; domain=thisdomain.com; secure; HttpOnly; SameSite=Lax
Content-Type: text/html; charset=UTF-8

This also adds the session.cookie_samesite INI setting as mentioned in bug ID #73454

As mentioned before, one should not set this to "true" to enable, but use one of the currently supported values of "Lax" or "Strict" as mentioned in the RFC.
These are the settings currently supported by Chrome and Opera (And probably soon in Firefox/Edge)

what about using constants (Cookies::SAMESITE_LAX ?) instead of strings?

I agree with that, constants a better idea than strings.

Good new article on using this cookie flag: https://scotthelme.co.uk/csrf-is-dead/

This should go into PHP ASAP, it's a vital security feature.

@xistence I noticed a small bug in the patch, here:

+	if (samesite) {
+		len += ZSTR_LEN(domain);
+	}

... should be ZSTR_LEN(samesite)

But either way, it would get more attention if you submit a PR through GitHub and start a discussion about it on the php-internals@ mailing list.

I'd like to see this happen ASAP, but I'm guessing the maintainers would opt to see what happens with https://tools.ietf.org/html/draft-west-first-party-cookies-07 first (and to be honest - that's reasonable).

Note that there is already a respective RFC (targetting PHP 7.3.0)
in voting phase: <https://wiki.php.net/rfc/same-site-cookie>.

The <https://wiki.php.net/rfc/same-site-cookie> RFC has been
accepted quite a while ago, but the implementation is still
missing.  A respective PR would be welcome!

Closing as it was implemented via http://git.php.net/?p=php-src.git;a=commit;h=08b9310e and http://git.php.net/?p=php-src.git;a=commit;h=2b58ab23