Support for SameSite attribute on cookies

Drupal 7 now supports the SameSite attribute on cookies. Drupal core uses this new functionality for its session cookies.

PHP introduced native support for the SameSite cookie attribute in PHP 7.3 so Drupal emulates this functionality for earlier PHP versions.

If you are using an earlier version of PHP than 7.3, Drupal will provide a default value of "None" for the SameSite attribute only if the cookie will also have the Secure attribute set, in accordance with the (proposed) specifications.

The order of precedence followed when deciding whether to set a SameSite attribute - and if so what value should be used - is documented in the new _drupal_samesite_cookie() function:

https://git.drupalcode.org/project/drupal/-/commit/7ba88d9d4f2d38f563c3f...

/**
 * Determine the value for the samesite cookie attribute, in the following order
 * of precedence:
 *
 * 1) A value explicitly passed to drupal_setcookie()
 * 2) A value set in $conf['samesite_cookie_value']
 * 3) The setting from php ini
 * 4) The default of None, or FALSE (no attribute) if the cookie is not Secure

Sites can provide their own value for this attribute by setting the samesite_cookie_value variable in settings.php (this applies to all PHP versions):

/**
 * SameSite cookie attribute.
 *
 * This variable can be used to set a value for the SameSite cookie attribute.
 *
 * Versions of PHP before 7.3 have no native support for the SameSite attribute
 * so it is emulated.
 *
 * The session.cookie-samesite setting in PHP 7.3 and later will be overridden
 * by this variable for Drupal session cookies, and any other cookies managed
 * with drupal_setcookie().
 *
 * Setting this variable to FALSE disables the SameSite attribute on cookies.
 *
 * @see drupal_setcookie()
 * @see drupal_session_start()
 * @see https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-samesite
 */
#$conf['samesite_cookie_value'] = 'None';

For PHP 7.3 and later, session.cookie-samesite can be used in your PHP configuration.

https://web.dev/samesite-cookies-explained/ provides a thorough explanation of the SameSite attribute and relevant changes in browser behaviour.