Laravel 5.2: TokenMismatchException on emended Iframe form on Chrome? - php

Question

I have Laravel application on version 5.2 to create dynamic forms which can be emended to any web-page using Iframe, forms were working fine couple of months ago, but now not working on Chrome(latest version) due to following:
this Set-Cookie didn't specify a "SameSite" attribute and was default to samesite=lax and was blocked because it came from the corss-site response which was not the response to a top-level navigtion. The Set-Cookie had to have been set with "SameSite=None" to enable cross-site requests.
Here is the Iframe with all attributes:
<iframe src="https://local.testproject.com/iframe/MSvnBNB9FT4H4m7kNi1OSJtdomsAxW3XnR6KZn1W9dStupbBLjYSfn7txRUNIDCa0UWCR4RbeiWJaMgy6JSDbZXzsFf8C6u32pUD5TiHPqJzxQiLwXXYm8SsUqHqhhoV" sandbox="allow-forms allow-modals allow-popups allow-scripts allow-same-origin allow-top-navigation" style="width: 100%; height: 650px; border: none;"></iframe>
For further see attached screenshot: https://prnt.sc/u6el89
I have researched lot, but did find anything yet. even I customized the core file vendor\symfony\http-foundation\Cookie.php
Following is the customized Cookie.php file:
<?php
/*
* This file is part of the Symfony package.
*
* (c) Fabien Potencier <fabien#symfony.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Symfony\Component\HttpFoundation;
/**
* Represents a cookie.
*
* #author Johannes M. Schmitt <schmittjoh#gmail.com>
*/
class Cookie
{
protected $name;
protected $value;
protected $domain;
protected $expire;
protected $path;
protected $secure;
protected $httpOnly;
protected $sameSite;
/**
* Constructor.
*
* #param string $name The name of the cookie
* #param string $value The value of the cookie
* #param int|string|\DateTimeInterface $expire The time the cookie expires
* #param string $path The path on the server in which the cookie will be available on
* #param string $domain The domain that the cookie is available to
* #param bool $secure Whether the cookie should only be transmitted over a secure HTTPS connection from the client
* #param bool $httpOnly Whether the cookie will be made accessible only through the HTTP protocol
*
* #throws \InvalidArgumentException
*/
public function __construct($name, $value = null, $expire = 0, $path = '/', $domain = null, $secure = false, $httpOnly = true, $sameSite='None')
{
// from PHP source code
if (preg_match("/[=,; \t\r\n\013\014]/", $name)) {
throw new \InvalidArgumentException(sprintf('The cookie name "%s" contains invalid characters.', $name));
}
if (empty($name)) {
throw new \InvalidArgumentException('The cookie name cannot be empty.');
}
// convert expiration time to a Unix timestamp
if ($expire instanceof \DateTimeInterface) {
$expire = $expire->format('U');
} elseif (!is_numeric($expire)) {
$expire = strtotime($expire);
if (false === $expire || -1 === $expire) {
throw new \InvalidArgumentException('The cookie expiration time is not valid.');
}
}
$this->name = $name;
$this->value = $value;
$this->domain = $domain;
$this->expire = $expire;
$this->path = empty($path) ? '/' : $path;
$this->secure = (bool) $secure;
$this->httpOnly = (bool) $httpOnly;
$this->sameSite = $sameSite;
}
/**
* Returns the cookie as a string.
*
* #return string The cookie
*/
public function __toString()
{
$str = urlencode($this->getName()).'=';
if ('' === (string) $this->getValue()) {
$str .= 'deleted; expires='.gmdate('D, d-M-Y H:i:s T', time() - 31536001);
} else {
$str .= urlencode($this->getValue());
if ($this->getExpiresTime() !== 0) {
$str .= '; expires='.gmdate('D, d-M-Y H:i:s T', $this->getExpiresTime());
}
}
if ($this->path) {
$str .= '; path='.$this->path;
}
if ($this->sameSite) {
$str .= '; SameSite='.$this->sameSite();
}
if ($this->getDomain()) {
$str .= '; domain='.$this->getDomain();
}
if (true === $this->isSecure()) {
$str .= '; secure';
}
if (true === $this->isHttpOnly()) {
$str .= '; httponly';
}
return $str;
}
/**
* Gets the name of the cookie.
*
* #return string
*/
public function getName()
{
return $this->name;
}
/**
* Gets the value of the cookie.
*
* #return string
*/
public function getValue()
{
return $this->value;
}
/**
* Gets the domain that the cookie is available to.
*
* #return string
*/
public function getDomain()
{
return $this->domain;
}
/**
* Gets the time the cookie expires.
*
* #return int
*/
public function getExpiresTime()
{
return $this->expire;
}
/**
* Gets the path on the server in which the cookie will be available on.
*
* #return string
*/
public function getPath()
{
return $this->path;
}
/**
* Checks whether the cookie should only be transmitted over a secure HTTPS connection from the client.
*
* #return bool
*/
public function isSecure()
{
return $this->secure;
}
/**
* Checks whether the cookie will be made accessible only through the HTTP protocol.
*
* #return bool
*/
public function isHttpOnly()
{
return $this->httpOnly;
}
/**
* Whether this cookie is about to be cleared.
*
* #return bool
*/
public function isCleared()
{
return $this->expire < time();
}
/**
* Whether this cookie same site.
*
* #return bool
*/
public function sameSite()
{
return $this->sameSite;
}
}
Also have added in parameter config/session.php:
/*
|--------------------------------------------------------------------------
| Same-Site Cookies
|--------------------------------------------------------------------------
|
| This option determines how your cookies behave when cross-site requests
| take place, and can be used to mitigate CSRF attacks. By default, we
| do not enable this as other CSRF protection services are in place.
|
| Supported: "lax", "strict", "none"
|
*/
'same_site' => 'None'
After that I modified the vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken.php and added new parameter same_site in following method:
protected function addCookieToResponse($request, $response)
{
$config = config('session');
$response->headers->setCookie(
new Cookie(
'XSRF-TOKEN', $request->session()->token(), time() + 60 * $config['lifetime'],
$config['path'], $config['domain'], $config['secure'], false, $config['same_site']
)
);
return $response;
}
Still no luck! I know that modifying core is the not good practice, but I just wanted to make this thing work. please guide how can I achieve this?
Thanks

Answer 1

The same_site attribute was added to laravel in version 5.5:
To use it you must update your laravel app or use simple trick which involves editing path attribute in config/session.php to:
'path' => '/;samesite=none',
And there you go!