added cookie fallback to Request::isFrom() for browsers without Sec-Fetch (Safari < 16.4)

Author: dg

src/Http/Request.php

@@ -8,7 +8,7 @@
 namespace Nette\Http;
 
 use Nette;
-use function array_change_key_case, base64_decode, count, explode, func_num_args, in_array, is_array, preg_match, strcasecmp, strlen, strtr;
+use function array_change_key_case, array_filter, base64_decode, count, explode, func_num_args, in_array, is_array, preg_match, strcasecmp, strlen, strtr;
 
 
 /**
@@ -240,6 +240,7 @@ public function isSameSite(): bool
 
 	/**
 	 * Checks whether the request matches the given Sec-Fetch-Site, Sec-Fetch-Dest and Sec-Fetch-User values.
+	 * Falls back to the SameSite=Strict cookie in browsers without Sec-Fetch (Safari < 16.4)
 	 * @param  FetchSite|list<FetchSite>  $site
 	 * @param  FetchDest|list<FetchDest>|null  $dest
 	 */
@@ -249,12 +250,20 @@ public function isFrom(
 		?bool $user = null,
 	): bool
 	{
-		$actualSite = FetchSite::tryFrom($this->headers['sec-fetch-site'] ?? '');
+		$siteHeader = $this->headers['sec-fetch-site'] ?? null;
 		$actualDest = FetchDest::tryFrom($this->headers['sec-fetch-dest'] ?? '');
 		$actualUser = ($this->headers['sec-fetch-user'] ?? null) === '?1';
 		$site = is_array($site) ? $site : [$site];
 		$dest = $dest === null || is_array($dest) ? $dest : [$dest];
 
+		if ($siteHeader === null) { // fallback for browsers without Sec-Fetch (Safari < 16.4)
+			return $dest === null
+				&& $user === null
+				&& isset($this->cookies[Helpers::StrictCookieName])
+				&& array_filter($site, fn(FetchSite $s) => $s !== FetchSite::CrossSite) !== [];
+		}
+
+		$actualSite = FetchSite::tryFrom($siteHeader);
 		return $actualSite !== null
 			&& in_array($actualSite, $site, strict: true)
 			&& ($dest === null || ($actualDest !== null && in_array($actualDest, $dest, strict: true)))

tests/Http/Request.isFrom.phpt

@@ -80,9 +80,46 @@ test('unknown header value matches nothing', function () {
 });
 
 
-test('no Sec-Fetch-Site returns false', function () {
+test('no header, no cookie returns false', function () {
 	$request = new Http\Request(new Http\UrlScript);
 
 	Assert::false($request->isFrom(FetchSite::SameOrigin));
 	Assert::false($request->isFrom(FetchSite::CrossSite));
 });
+
+
+test('cookie fallback proves only "not cross-site"', function () {
+	$request = new Http\Request(new Http\UrlScript, cookies: [
+		Http\Helpers::StrictCookieName => '1',
+	]);
+
+	Assert::true($request->isFrom(FetchSite::SameOrigin));
+	Assert::true($request->isFrom(FetchSite::SameSite));
+	Assert::true($request->isFrom(FetchSite::None));
+	Assert::true($request->isFrom([FetchSite::SameOrigin, FetchSite::CrossSite]));
+	Assert::false($request->isFrom(FetchSite::CrossSite));
+});
+
+
+test('cookie fallback fails closed for dest & user', function () {
+	$request = new Http\Request(new Http\UrlScript, cookies: [
+		Http\Helpers::StrictCookieName => '1',
+	]);
+
+	// dest/user can't be proven by the cookie alone, so a stricter check must not pass
+	Assert::false($request->isFrom(FetchSite::SameOrigin, FetchDest::Document));
+	Assert::false($request->isFrom(FetchSite::SameOrigin, user: true));
+	Assert::false($request->isFrom(FetchSite::SameOrigin, user: false));
+});
+
+
+test('cookie fallback not used when Sec-Fetch-Site present', function () {
+	$request = new Http\Request(new Http\UrlScript, cookies: [
+		Http\Helpers::StrictCookieName => '1',
+	], headers: [
+		'Sec-Fetch-Site' => 'cross-site',
+	]);
+
+	Assert::false($request->isFrom(FetchSite::SameOrigin));
+	Assert::true($request->isFrom(FetchSite::CrossSite));
+});