diff --git a/bl-kernel/helpers/session.class.php b/bl-kernel/helpers/session.class.php index 7d59151e..50f80244 100644 --- a/bl-kernel/helpers/session.class.php +++ b/bl-kernel/helpers/session.class.php @@ -5,6 +5,11 @@ class Session { private static $started = false; private static $sessionName = 'KOBLOG-KEY'; + public static function getSessionName() + { + return (array_key_exists('HTTPS', $_SERVER) ? "__Secure-" : "") . self::$sessionName; + } + public static function start($path, $secure) { // Try to set the session timeout on server side, 1 hour of timeout @@ -26,11 +31,12 @@ class Session { 'path' => $path, 'domain' => $cookieParams["domain"], 'secure' => $secure, - 'httponly' => true + 'httponly' => true, + 'samesite' => 'strict' ]); // Sets the session name to the one set above. - session_name(self::$sessionName); + session_name(self::getSessionName()); // Start session. self::$started = session_start(); @@ -52,8 +58,8 @@ class Session { { session_destroy(); unset($_SESSION); - unset($_COOKIE[self::$sessionName]); - Cookie::set(self::$sessionName, '', -1); + unset($_COOKIE[self::getSessionName()]); + Cookie::set(self::getSessionName(), '', -1); self::$started = false; Log::set(__METHOD__.LOG_SEP.'Session destroyed.'); return !isset($_SESSION);