#37000 Set SameSite to Lax via a new `setcookie()` wrapper by johnbillion · Pull Request #12444 · WordPress/wordpress-develop

johnbillion · 2026-07-07T23:23:34Z

The SameSite attribute on a cookie is a form of CSRF protection that controls whether the browser attaches it to a request based on the request type (top-level navigation, iframe, link click, etc) and whether the request's site matches the top-level browsing context.

A value of Strict means the cookie will only be attached to the request if its site matches the top-level URL in the browser when the request was triggered. The cookie will not be sent if the request is triggered by or via a third party site, for example clicking a link on another site, submitting a form on another site, or iframing the page into another site.
A value of Lax relaxes this behaviour so the cookie will be attached when clicking a link on another site, but still not sent in other contexts.
A value of None means the cookie will always be sent regardless of the context.

See SameSite cookies explained for more info.

The default value for SameSite in Chromium-based browsers has been set to Lax since 2020. This breaks some less-common use cases such as iframing a site, but just as importantly, results in inconsistency across browsers because neither Firefox nor Safari do the same.

For consistency and explicitness, the SameSite attribute should be set to Lax everywhere, and a filter should be introduced to control the values of cookie attributes.

Changes

Since the minimum supported version of PHP is now > 7.3 we can switch to using the array signature for setcookie() options and specify a value for the SameSite flag for consistency.

In order to standardise setting SameSite to Lax in all browsers, facilitate being able to change the SameSite value for any given cookie (either to tighten it to Strict or loosen it to None), and to make everything more testable, this PR makes the following changes:

Adds a wp_set_cookie() wrapper function with filters for controlling the cookie options and whether cookies are sent. This increases the testability of functions that set cookies.
Adds a wp_unset_cookie() function as a convenience wrapper for unsetting cookies.
Explicitly sets the samesite option to Lax. I have not identified any cookie that's set by WordPress that would benefit from a SameSite value of Strict, and none that need downgrading to None.

Consderations

As far as I can tell, everything that might break as a result of this change has already been broken in all browsers since 2022, primarily iframing a site inside another site and allowing the user of the iframed site to remain logged in.

This change standardises the attribute for consistency and introduces the ability for site owners to adjust its value on a per-cookie basis.

Supporting info

Drupal, Symfony, Laravel, Django, RoR, ASP.NET, Magento, and many other frameworks default to explicitly setting SameSite to Lax rather than relying on an implied default in browsers.

Trac ticket: https://core.trac.wordpress.org/ticket/37000

… using the array signature for options.

… cookie.

github-actions · 2026-07-07T23:23:44Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props johnbillion, wildworks, westonruter, swissspidy, mukesh27, dmsnell, nimeshatxecurify.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-07-07T23:27:48Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>

t-hamano · 2026-07-14T08:19:49Z

If this PR is ready for release, I would appreciate it if you could commit it before tomorrow's 7.1 beta1 commit freeze.

westonruter · 2026-07-15T08:03:28Z

The changed non-test code passes PHPStan rule level 10 (essentially).

westonruter

LGTM

Copilot

Pull request overview

This PR standardizes cookie setting across core by introducing a setcookie() wrapper that supports centralized filtering and easier test interception, while explicitly setting SameSite=Lax for consistency across browsers.

Changes:

Introduces wp_set_cookie() / wp_unset_cookie() wrappers with filters to adjust options and short-circuit sending.
Migrates multiple core cookie call sites to use the wrapper and explicitly sets samesite => 'Lax'.
Updates PHPUnit infrastructure/tests to prevent header warnings and to capture/assert cookie sends via the new send_cookie filter.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/phpunit/tests/option/wpUserSettings.php	Updates the user settings cookie test to capture cookies via `send_cookie`.
tests/phpunit/tests/functions/wpSetCookie.php	Adds new unit test coverage for `wp_set_cookie()` / `wp_unset_cookie()` filtering.
tests/phpunit/includes/functions.php	Switches PHPUnit harness to disable cookie sending via `send_cookie` to avoid header warnings.
src/wp-login.php	Replaces direct `setcookie()` calls with `wp_set_cookie()` / `wp_unset_cookie()` and sets `SameSite=Lax`.
src/wp-includes/pluggable.php	Migrates auth cookie set/clear operations to the new cookie wrappers and documents `send_cookie`.
src/wp-includes/option.php	Updates user settings cookie set/unset logic to use the new wrappers with `SameSite=Lax`.
src/wp-includes/functions.php	Adds the new `wp_set_cookie()` / `wp_unset_cookie()` wrapper functions and filters.
src/wp-includes/comment.php	Migrates comment author cookies to the wrapper and sets `SameSite=Lax`.
src/wp-includes/class-wp-recovery-mode-cookie-service.php	Migrates recovery-mode cookie set/clear to the wrapper and sets `SameSite=Lax`.
src/wp-admin/post.php	Migrates the `wp-saving-post` cookie to the wrapper and sets `SameSite=Lax`.
src/wp-activate.php	Migrates activation cookie set/clear to the wrapper and sets `SameSite=Lax`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+	 * @param string $name    The name of the cookie.
+	 * @param string $value   The value of the cookie.
+	 */
+	$options = apply_filters( 'wp_set_cookie_options', $options, $name, $value );


+	if ( ! apply_filters( 'send_cookie', true, $name, $value, $options ) ) {
+		return false;
+	}


+/**
+ * Removes a cookie from the browser.
+ *
+ * Sends a cookie with an empty value and an expiry time in the past, which


+		$options = $this->sent_cookies[0]['options'];
+


+		$this->assertArrayHasKey( 'wp-settings-' . $user_id, $this->sent_cookies );
+		$this->assertSame( 'foo=bar', $this->sent_cookies[ 'wp-settings-' . $user_id ]['value'] );
+
+		// The companion timestamp cookie is also sent.
+		$this->assertArrayHasKey( 'wp-settings-time-' . $user_id, $this->sent_cookies );


nimesh-xecurify · 2026-07-15T10:33:43Z

This looks great overall. One suggestion on the wp_set_cookie() design: could it default samesite to Lax (e.g., via wp_parse_args()) rather than relying on every call site passing it explicitly?

As written, the goal of the patch is only enforced by convention. Any future core call site (or any plugin adopting the wrapper) that omits samesite silently falls back to browser defaults, which is exactly the inconsistency this ticket is trying to fix. A default in the wrapper turns that from a silent regression into a non-issue and would trim a fair bit of repetition from the call sites.

There's decent precedent for core wrappers being opinionated where the underlying primitive is unsafe or inconsistent: wp_remote_get() defaults sslverify to true, and wp_safe_redirect() exists for basically this reason. wp_parse_args() + filter is also the usual shape for options arrays elsewhere in core.

dmsnell · 2026-09-01T19:21:02Z

@johnbillion the WP Consent API plugin already defines wp_set_cookie() (thanks Codex for surfacing that).

it’s unfortunate naming, but I guess that’s also an official plugin? there is probably reason to avoid the collision. looks like more than 200,000 active installs reported for that one.

dmsnell · 2026-09-01T19:26:10Z

+ *     @type string $domain   The (sub)domain that the cookie is available to.
+ *     @type bool   $secure   Indicates that the cookie should only be transmitted over a secure HTTPS connection from the client.
+ *     @type bool   $httponly When true the cookie will be made accessible only through the HTTP protocol.
+ *     @type string $samesite Whether the cookie should be available for cross-site requests. Accepts 'Lax', 'Strict', or 'None'.


the claim is that this accepts these values, but we never verify that. perhaps it would be worth adding a check and a _doing_it_wrong(), given the sensitive nature of this flag.

additionally, are we setting the default values anywhere? what if someone passes the options but omits the samesite property? perhaps we would want to use latching logic instead on some of these properties.

something like this…

$options = filter… $options = filter… … $options['samesite'] = isset( $options['samesite'] ) && in_array( $options['samesite'], array( 'Lax', 'Strict', 'None' ), true ) ? $options['samesite'] : 'Lax;

the claim is that this accepts these values, but we never verify that. perhaps it would be worth adding a check and a _doing_it_wrong(), given the sensitive nature of this flag.

Good point. Apparently PHP doesn't do any validation here either, passing through strings verbatim. At least there is PHPStan typing added to help guard against this, but it is case-sensitive. We could do case-insensitive checking and raise _doing_it_wrong() if there is no match.

Something that Claude pointed out is that SameSite=None doesn't do anything unless Secure is also set. So perhaps _doing_it_wrong() should be raised if SameSite is being set but Secure isn't, cf. MDN:

Send the cookie with both cross-site and same-site requests. The Secure attribute must also be set when using this value.

dmsnell · 2026-09-01T19:28:11Z

+ *     samesite?: 'Lax'|'Strict'|'None',
+ * } $options
+ */
+function wp_set_cookie( string $name, string $value, array $options = array() ): bool {


should wpCookies.set() in JavaScript also be updated to avoid inconsistencies between JS fetches and HTML-originated browser fetches? or does the policy carry over?

dmsnell · 2026-09-01T19:30:14Z

the copilot reviews on the filter outputs seem relevant given the context of what this function is doing. either by mistake or by intent, it would be good to guard the most-essential cookie properties

johnbillion added 4 commits July 7, 2026 22:53

Introduce a wp_set_cookie() function as a wrapper for setcookie()…

897362b

… using the array signature for options.

Introduce a wp_unset_cookie() function as a wrapper for unsetting a…

38af3a1

… cookie.

Docs and tests.

af642d3

Add a test to cover the cookie option filtering.

30edc99

johnbillion mentioned this pull request Jul 7, 2026

Feature/wp setcookie #687

Closed

johnbillion requested review from getsource and swissspidy July 7, 2026 23:39

Coding standards.

2cb6e99

swissspidy approved these changes Jul 8, 2026

View reviewed changes

johnbillion mentioned this pull request Jul 9, 2026

WooCommerce HPOS declarations, SameSite cookies, and RTL fix suggestions johnbillion/user-switching#266

Closed

mukeshpanchal27 reviewed Jul 9, 2026

View reviewed changes

Comment thread tests/phpunit/tests/functions/wpSetCookie.php

Update tests/phpunit/tests/functions/wpSetCookie.php

ed455dc

Co-authored-by: Mukesh Panchal <mukeshpanchal27@users.noreply.github.com>

johnbillion requested review from SergeyBiryukov and westonruter July 14, 2026 12:02

t-hamano and others added 6 commits July 15, 2026 15:53

Merge branch 'trunk' into 37000-samesite

58afb51

Merge branch 'trunk' into 37000-samesite

f1f6a41

Add array shapes to phpdoc

35b58f4

Provide versions

09ec3d6

Widen some types

33c0e22

Fix types of values for supplied options

81d8cbf

westonruter requested a review from Copilot July 15, 2026 08:04

westonruter approved these changes Jul 15, 2026

View reviewed changes

Copilot started reviewing on behalf of westonruter July 15, 2026 08:05 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

dmsnell reviewed Sep 1, 2026

View reviewed changes

Navigation Menu

Uh oh!

#37000 Set SameSite to Lax via a new `setcookie()` wrapper - #12444

#37000 Set SameSite to Lax via a new `setcookie()` wrapper#12444
johnbillion wants to merge 12 commits into
WordPress:trunkfrom
johnbillion:37000-samesite

johnbillion commented Jul 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

Uh oh!

t-hamano commented Jul 14, 2026

Uh oh!

westonruter commented Jul 15, 2026 •

edited

Loading

Uh oh!

westonruter left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

nimesh-xecurify commented Jul 15, 2026

Uh oh!

dmsnell commented Sep 1, 2026

Uh oh!

dmsnell Sep 1, 2026

Uh oh!

westonruter Sep 1, 2026

Uh oh!

dmsnell Sep 1, 2026

Uh oh!

dmsnell commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Uh oh!

Conversation

johnbillion commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Consderations

Supporting info

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 7, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

Uh oh!

t-hamano commented Jul 14, 2026

Uh oh!

westonruter commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

westonruter left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

nimesh-xecurify commented Jul 15, 2026

Uh oh!

dmsnell commented Sep 1, 2026

Uh oh!

dmsnell Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

westonruter Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

dmsnell Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

dmsnell commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

johnbillion commented Jul 7, 2026 •

edited

Loading

github-actions Bot commented Jul 7, 2026 •

edited

Loading

westonruter commented Jul 15, 2026 •

edited

Loading