fix: ucfirst all cookie samesite values (#9564)

* fix: ucfirst all cookie samesite values

* Fix doc sample

* Add changelog

* Fix review

* Add case-insensitive validation of SameSite

Author: paulbalandan

system/Cookie/Cookie.php

@@ -766,11 +766,11 @@ protected function validateSameSite(string $samesite, bool $secure): void
             $samesite = self::SAMESITE_LAX;
         }
 
-        if (! in_array(strtolower($samesite), self::ALLOWED_SAMESITE_VALUES, true)) {
+        if (! in_array(ucfirst(strtolower($samesite)), self::ALLOWED_SAMESITE_VALUES, true)) {
             throw CookieException::forInvalidSameSite($samesite);
         }
 
-        if (strtolower($samesite) === self::SAMESITE_NONE && ! $secure) {
+        if (ucfirst(strtolower($samesite)) === self::SAMESITE_NONE && ! $secure) {
             throw CookieException::forInvalidSameSiteNone();
         }
     }

system/Cookie/CookieInterface.php

@@ -25,20 +25,20 @@ interface CookieInterface
      * first-party and cross-origin requests. If `SameSite=None` is set,
      * the cookie `Secure` attribute must also be set (or the cookie will be blocked).
      */
-    public const SAMESITE_NONE = 'none';
+    public const SAMESITE_NONE = 'None';
 
     /**
      * Cookies are not sent on normal cross-site subrequests (for example to
      * load images or frames into a third party site), but are sent when a
      * user is navigating to the origin site (i.e. when following a link).
      */
-    public const SAMESITE_LAX = 'lax';
+    public const SAMESITE_LAX = 'Lax';
 
     /**
      * Cookies will only be sent in a first-party context and not be sent
      * along with requests initiated by third party websites.
      */
-    public const SAMESITE_STRICT = 'strict';
+    public const SAMESITE_STRICT = 'Strict';
 
     /**
      * RFC 6265 allowed values for the "SameSite" attribute.

user_guide_src/source/changelogs/v4.7.0.rst

@@ -97,6 +97,8 @@ Deprecations
 Bugs Fixed
 **********
 
+- **Cookie:** The ``CookieInterface::SAMESITE_STRICT``, ``CookieInterface::SAMESITE_LAX``, and ``CookieInterface::SAMESITE_NONE`` constants are now written in ucfirst style to be consistent with usage in the rest of the framework.
+
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_
 for a complete list of bugs fixed.

user_guide_src/source/libraries/cookies/006.php

@@ -2,6 +2,6 @@
 
 use CodeIgniter\Cookie\Cookie;
 
-Cookie::SAMESITE_LAX;       // 'lax'
-Cookie::SAMESITE_STRICT;    // 'strict'
-Cookie::SAMESITE_NONE;      // 'none'
+Cookie::SAMESITE_LAX;    // 'Lax'
+Cookie::SAMESITE_STRICT; // 'Strict'
+Cookie::SAMESITE_NONE;   // 'None'