The SameSite=Strict cookie configuration prevent the browser to send the cookies to the server when any request, including GET requests, are initiated from an external application/website. It mitigate attacks based on maliciuous links, since it triggers a reauthentication.
Still, we did not forced it yet because it would also break links present in the email notifications.
To be able to force the usage of this option, we have to catch URLs matching to notification links (see NotificationTarget::formatURL()), and use a rebounce system like we already do in the /front/smtp_oauth2_callback.php script.
The
SameSite=Strictcookie configuration prevent the browser to send the cookies to the server when any request, including GET requests, are initiated from an external application/website. It mitigate attacks based on maliciuous links, since it triggers a reauthentication.Still, we did not forced it yet because it would also break links present in the email notifications.
To be able to force the usage of this option, we have to catch URLs matching to notification links (see
NotificationTarget::formatURL()), and use a rebounce system like we already do in the/front/smtp_oauth2_callback.phpscript.