diff --git a/src/Cookies.php b/src/Cookies.php index db8174f..02d4e3c 100644 --- a/src/Cookies.php +++ b/src/Cookies.php @@ -170,7 +170,7 @@ protected function toHeader(string $name, array $properties): string $result .= '; HttpOnly'; } - if (isset($properties['samesite']) && in_array(strtolower($properties['samesite']), ['lax', 'strict'], true)) { + if (isset($properties['samesite']) && in_array(strtolower($properties['samesite']), ['lax', 'strict', 'none'], true)) { // While strtolower is needed for correct comparison, the RFC doesn't care about case $result .= '; SameSite=' . $properties['samesite']; } diff --git a/tests/CookiesTest.php b/tests/CookiesTest.php index 0c1d84a..a5bdac6 100644 --- a/tests/CookiesTest.php +++ b/tests/CookiesTest.php @@ -275,4 +275,11 @@ public function testParseHeaderException() Cookies::parseHeader(new stdClass()); } + + public function testSetSameSiteNoneToHeaders() + { + $cookies = new Cookies(); + $cookies->set('foo', ['value' => 'bar', 'samesite' => 'None']); + $this->assertEquals('foo=bar; SameSite=None', $cookies->toHeaders()[0]); + } }