Ayesh Karunaratne

<p>This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.</p>
<p>SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to <strong>support all PHP versions</strong> WordPress supports.</p>
<p>There is no administrative UI provided: Activate this plugin, and you are all set!</p>
<p>You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from <code>Lax</code> (default), <code>Strict</code>, or <code>None</code>. You can read about <a href="https://php.watch/articles/PHP-Samesite-cookies" rel="nofollow ugc">SameSite cookies here</a>.</p>
<p>To configure the <code>SameSite</code> flag value, edit your WordPress configuration file (<code>wp-config.php</code>), and add the following lines right above <code>/** Sets up WordPress vars and included files. */</code>.</p>
<pre><code>define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
</code></pre>
<p>Note that <strong>only the authentication cookies are affected</strong>. Regular cookies that your installed plugins set will <strong>not</strong> be affected, nor provide any meaningful value with <code>SameSite</code> flags.</p>


SameSite Cookies

Wasted two days on this

I don't know why the Author created this plugin, It does not work, please remove it from the plugin library

The plugin doesn't work

CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.

Marco van Wieren

<p>Plugin for WordPress websites that require a user to sign in (e.g. with Microsoft using the <a href="https://wordpress.org/plugins/wpo365-login/" rel="ugc">WPO365</a> plugin) and that are loaded inside an iframe (e.g. inside a Microsoft Teams App / Tab or similar). The plugin overrides the pluggable WordPress function <strong>wp_set_auth_cookie</strong> to <em>always</em> set <strong>SameSite=None</strong> to enable third-party usage of cookies.</p>
<h4>Prerequisites</h4>
<ul>
<li>The <strong>SameSite=None</strong> flag is only respected by browsers such as Chrome when the cookie’s Secure flag is set. Therefore the website must use SSL for the plugin to effectively enable browser support for 3rd party cookies.</li>
</ul>
<h4>Support</h4>
<p>I will go to great length trying to support you if the plugin doesn’t work as expected. Go to our <a href="https://www.wpo365.com/how-to-get-support/" rel="nofollow ugc">Support Page</a> to get in touch. I haven’t been able to test our plugin in all endless possible WordPress configurations and versions so I am keen to hear from you and happy to learn!</p>
<h4>Feedback</h4>
<p>I am keen to hear from you so share your feedback with me on <a href="https://twitter.com/WPO365" rel="nofollow ugc">Twitter</a> and help me get better!</p>
<h4>Open Source</h4>
<p>When you’re a developer and interested in the code you should have a look at the corresponding gist at <a href="https://gist.github.com/wpo365/b0a1c3c8c5612fd0012de2e2f65c09c4" rel="nofollow ugc">github</a>.</p>


WPO365 | SAMESITE

Plugin for WordPress websites that require a user to sign in (e.g. with Microsoft using the WPO365 plugin) and that are loaded inside an iframe (e.g.

SameSite Cookies vs WPO365 | SAMESITE