From 1ef014907625d39232ab6df6145419d7b3af32c4 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Mon, 6 Oct 2025 11:00:03 +0200
Subject: [PATCH] [Web] make SameSite policy and cookie name configurable via
 vars.local.inc

---
 data/web/inc/sessions.inc.php | 4 ++--
 data/web/inc/vars.inc.php     | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/data/web/inc/sessions.inc.php b/data/web/inc/sessions.inc.php
index 68b3d5585..8f3192d70 100644
--- a/data/web/inc/sessions.inc.php
+++ b/data/web/inc/sessions.inc.php
@@ -1,9 +1,9 @@
 <?php
 // Start session
 if (session_status() !== PHP_SESSION_ACTIVE) {
-  session_name('MCSESSID');
+  session_name($SESSION_NAME);
   ini_set("session.cookie_httponly", 1);
-  ini_set("session.cookie_samesite", "Lax");
+  ini_set("session.cookie_samesite", $SESSION_SAMESITE_POLICY);
   ini_set('session.gc_maxlifetime', $SESSION_LIFETIME);
 }
 
diff --git a/data/web/inc/vars.inc.php b/data/web/inc/vars.inc.php
index 568105308..a24752a6d 100644
--- a/data/web/inc/vars.inc.php
+++ b/data/web/inc/vars.inc.php
@@ -153,6 +153,13 @@ $LOG_PAGINATION_SIZE = 50;
 // Session lifetime in seconds
 $SESSION_LIFETIME = 10800;
 
+// Session SameSite Policy
+// Use "None", "Lax" or "Strict"
+$SESSION_SAMESITE_POLICY = "Lax";
+
+// Name of the session cookie
+$SESSION_NAME = "MCSESSID";
+
 // Label for OTP devices
 $OTP_LABEL = "mailcow UI";