Set SameSite=none when embedding into frames is allowed

Resolves #4428

diff --git a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
index d51d8229b3612a21791c9a251c1ecce54d83d129..a5f07047be2411254c00d43650c8742bee158d06 100644 (file)
--- a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
@@ -498,6 +498,10 @@ final class SessionHandler extends SingletonFactory
                 $sameSite = '; SameSite=strict';
             }
 
+            if (!HTTP_SEND_X_FRAME_OPTIONS) {
+                $sameSite = '; SameSite=none';
+            }
+
             \header(
                 'set-cookie: XSRF-TOKEN=' . \rawurlencode($xsrfToken) . '; path=/' . $cookieDomain . (RouteHandler::secureConnection() ? '; secure' : '') . $sameSite,
                 false

diff --git a/wcfsetup/install/files/lib/util/HeaderUtil.class.php b/wcfsetup/install/files/lib/util/HeaderUtil.class.php
index 8c62084ba2ee4ca547872fb1bad2d948829f6c59..b0664b62186ac3c103951953b2b01b44c4db5cff 100644 (file)
--- a/wcfsetup/install/files/lib/util/HeaderUtil.class.php
+++ b/wcfsetup/install/files/lib/util/HeaderUtil.class.php
@@ -41,11 +41,16 @@ final class HeaderUtil
     {
         $cookieDomain = self::getCookieDomain();
 
+        $sameSite = '';
+        if (!HTTP_SEND_X_FRAME_OPTIONS) {
+            $sameSite = '; SameSite=none';
+        }
+
         @\header(
             'Set-Cookie: ' . \rawurlencode(COOKIE_PREFIX . $name) . '=' . \rawurlencode((string)$value) . ($expire ? '; expires=' . \gmdate(
                 'D, d-M-Y H:i:s',
                 $expire
-            ) . ' GMT; max-age=' . ($expire - TIME_NOW) : '') . '; path=/' . ($cookieDomain !== null ? '; domain=' . $cookieDomain : '') . (RouteHandler::secureConnection() ? '; secure' : '') . '; HttpOnly',
+            ) . ' GMT; max-age=' . ($expire - TIME_NOW) : '') . '; path=/' . ($cookieDomain !== null ? '; domain=' . $cookieDomain : '') . (RouteHandler::secureConnection() ? '; secure' : '') . $sameSite . '; HttpOnly',
             false
         );
     }