PHP error guide

SameSite blocks PHP session cookie: meaning and fix

warning other Affects: PHP 7.4–8.4 Last verified:

Error summary

Choose SameSite from the actual navigation or embedded flow; cross-site cookies requiring None must also be Secure and served over HTTPS.

What it means

Choose SameSite from the actual navigation or embedded flow; cross-site cookies requiring None must also be Secure and served over HTTPS.

What the error means

The browser withholds or rejects the session cookie because the request context does not satisfy its SameSite policy.

Why PHP produces it

An embedded, federated-login, payment-return, or cross-origin request needs cookie behavior different from the configured Lax or Strict mode.

PHP version notes

The behavior described for SameSite blocks PHP session cookie applies to PHP 7.4–8.4 unless a narrower version is stated; exact wording can vary by SAPI and patch release.

Most common causes

  • An iframe needs a cross-site session cookie.
  • An OAuth or payment POST return is blocked by Strict or Lax behavior.
  • SameSite=None is sent without Secure.

Minimal examples

BAD — reproduces the problem

php 
session_set_cookie_params(["samesite" => "None", "secure" => false]);

FIXED — safer pattern

php 
session_set_cookie_params(["samesite"=>"None", "secure"=>true, "httponly"=>true]);

Step-by-step diagnosis

  1. Read the browser cookie issue message and request site context.
  2. Inspect the exact Set-Cookie attributes.
  3. Map whether the flow is top-level navigation, subresource, iframe, GET, or POST.

Fixes

Set attributes for the documented flow

Use Lax for ordinary first-party sessions; use None plus Secure only where cross-site cookies are required.

php 
session_set_cookie_params([
    "secure" => true,
    "httponly" => true,
    "samesite" => "None",
]);

Common mistakes when fixing it

  • Setting None on every cookie without need.
  • Confusing CORS response headers with cookie SameSite.
  • Testing only direct same-site navigation.

How to prevent it

  • Document cross-site authentication flows.
  • Use HTTPS and explicit cookie attributes.
  • Test the actual redirect or embed workflow.

Web server / environment notes

fpm, apache. The browser enforces SameSite based on the surrounding request context.

Tags: fpm,apache

Categories