Fix #135: Add the secureCookie parameter to enable CookieLogin to set a cookie when an HTTP request is made

CHANGELOG.md

@@ -6,6 +6,7 @@
 - Enh #127: Bump `yiisoft/auth` version to `^3.3.0`, and fix deprecated classes usage (@klsoft-web, @vjik)
 - Enh #132: Bump `yiisoft/session` version to `^3.0.2` (@vjik)
 - New #126: Add optional HMAC signing of the auto-login cookie value via `CookieLogin` signature key (@vjik)
+- Enh #135: Add the `secureCookie` parameter to enable `CookieLogin` to set a cookie when an HTTP request is made (@klsoft-web)
 
 ## 2.3.2 December 23, 2025
 

README.md

@@ -349,12 +349,17 @@ return [
         'cookieLogin' => [
             'forceAddCookie' => true,
             'duration' => 'P5D', // 5 days
+            'secureCookie' => true, // whether the client should send back the cookie only over HTTPS connection
         ],
     ],
 ];
 ```
 
 > If you want the cookie to be a session cookie, change the duration to `null`.
+> To enable a cookie to be set when an HTTP request is made, change the `secureCookie` to `false`.
+
+> [!warning]
+> With secureCookie turned off, it travels in cleartext and can be captured and replayed for the full duration of cookie lifetime (5 days by default).
 
 #### Removing a cookie
 

config/di-web.php

@@ -44,6 +44,7 @@
                 new DateInterval($params['yiisoft/user']['cookieLogin']['duration']) :
                 null,
             'signatureKey' => $params['yiisoft/user']['cookieLogin']['signatureKey'],
+            'secureCookie' => $params['yiisoft/user']['cookieLogin']['secureCookie'],
         ],
     ],
 ];

config/params.php

@@ -9,6 +9,7 @@
             'forceAddCookie' => false,
             'duration' => 'P5D', // 5 days, see format on https://www.php.net/manual/dateinterval.construct.php
             'signatureKey' => null, // secret key to sign the auto-login cookie value; keep `null` to store it unsigned
+            'secureCookie' => true, // whether the client should send back the cookie only over HTTPS connection
         ],
     ],
 ];

src/Login/Cookie/CookieLogin.php

@@ -50,10 +50,12 @@
      * the auto-login cookie is session cookie that expires when browser is closed.
      * @param string|null $signatureKey Secret key used to sign the auto-login cookie value with HMAC-SHA256. If it
      * isn't set, the cookie value is stored without a signature and isn't protected against tampering.
+     * @param bool $secureCookie Whether the client should send back the cookie only over HTTPS connection.
      */
     public function __construct(
         private readonly ?DateInterval $duration = null,
         private readonly ?string $signatureKey = null,
+        private readonly bool $secureCookie = true,
     ) {}
 
     /**
@@ -63,7 +65,7 @@
      */
     public function withCookieName(string $name): self
     {
         $new = clone $this;
         $new->cookieName = $name;
         return $new;
     }
@@ -93,7 +95,7 @@
 
         $cookieValue = $this->createValue((string) $identity->getId(), $identity->getCookieLoginKey(), $expires);
 
-        return (new Cookie(name: $this->cookieName, value: $cookieValue, expires: $expires))
+        return (new Cookie(name: $this->cookieName, value: $cookieValue, expires: $expires, secure: $this->secureCookie))
             ->addToResponse($response);
     }
 
@@ -106,7 +108,7 @@
      */
     public function expireCookie(ResponseInterface $response): ResponseInterface
     {
-        return (new Cookie($this->cookieName))
+        return (new Cookie($this->cookieName, secure: $this->secureCookie))
             ->expire()
             ->addToResponse($response);
     }
@@ -140,7 +142,7 @@
         }
 
         try {
             $data = json_decode($payload, true, 512, JSON_THROW_ON_ERROR);
         } catch (Throwable) {
             return null;
         }
@@ -174,7 +176,7 @@
     {
         $payload = json_encode(
             [$id, $key, $expiresDate?->getTimestamp() ?? 0],
             JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE,
         );
 
         return $this->signatureKey === null ? $payload : $this->sign($payload, $this->signatureKey);
@@ -204,7 +206,7 @@
     private function getVerifiedPayload(string $value, string $signatureKey): ?string
     {
         if (strlen($value) <= self::SIGNATURE_LENGTH || $value[self::SIGNATURE_LENGTH] !== '.') {
             return null;
         }
 
         $signature = substr($value, 0, self::SIGNATURE_LENGTH);

tests/ConfigTest.php

@@ -52,6 +52,7 @@ public function testBase(): void
             ->getInaccessibleProperty($cookieLogin, 'duration')
             ->d);
         $this->assertNull($this->getInaccessibleProperty($cookieLogin, 'signatureKey'));
+        $this->assertTrue($this->getInaccessibleProperty($cookieLogin, 'secureCookie'));
 
         $cookieLoginMiddleware = $container->get(CookieLoginMiddleware::class);
 
@@ -68,6 +69,7 @@ public function testOverrideParams(): void
                     'forceAddCookie' => true,
                     'duration' => 'P2D',
                     'signatureKey' => 'test-signature-key',
+                    'secureCookie' => false
                 ],
             ],
         ]);
@@ -86,6 +88,7 @@ public function testOverrideParams(): void
             ->getInaccessibleProperty($cookieLogin, 'duration')
             ->d);
         $this->assertSame('test-signature-key', $this->getInaccessibleProperty($cookieLogin, 'signatureKey'));
+        $this->assertFalse($this->getInaccessibleProperty($cookieLogin, 'secureCookie'));
 
         $cookieLoginMiddleware = $container->get(CookieLoginMiddleware::class);
 

tests/Login/Cookie/CookieLoginTest.php

@@ -238,6 +238,22 @@ public function testParseValueInvalidUnsigned(string $value): void
         $this->assertNull($cookieLogin->parseValue($value));
     }
 
+    public function testAddCookieWithDisableSecureCookie(): void
+    {
+        $cookieLogin = new CookieLogin(secureCookie: false);
+
+        $identity = new CookieLoginIdentity();
+
+        $response = new Response();
+        $response = $cookieLogin->addCookie($identity, $response);
+
+        $this->assertMatchesRegularExpression(
+            '#autoLogin=%5B%2242%22%2C%22auto-login-key-correct%22%2C0%5D;'
+            . ' Path=/; HttpOnly; SameSite=Lax#',
+            $response->getHeaderLine('Set-Cookie'),
+        );
+    }
+
     private function extractCookieValue(string $setCookieHeader): string
     {
         $pair = explode(';', $setCookieHeader, 2)[0];