HttpExtension: option 'sameSiteProtection' does not change session cookie flag 'samesite'

Author: dg

src/Bridges/HttpDI/HttpExtension.php

@@ -82,11 +82,6 @@ public function beforeCompile()
 			$builder->getDefinitionByType(Nette\Http\Session::class)
 				->addSetup('setOptions', [['cookie_secure' => $value]]);
 		}
-
-		if (!empty($this->config['sameSiteProtection'])) {
-			$builder->getDefinitionByType(Nette\Http\Session::class)
-				->addSetup('setOptions', [['cookie_samesite' => 'Lax']]);
-		}
 	}
 
 

tests/Http.DI/HttpExtension.sameSiteProtection.phpt

@@ -36,4 +36,4 @@ Assert::contains(
 		: 'Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly',
 	$headers
 );
-Assert::same('Lax', $container->getService('session.session')->getOptions()['cookie_samesite']);
+Assert::true(empty($container->getService('session.session')->getOptions()['cookie_samesite']));