flarum / flarum/issue-archive

Locale cookie for guests doesn't follow any of the cookie rules

Open
#145 3 comments 0 reactions 0 assignees View on GitHub
type/cleanup
Dominant language
No language data
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

The `locale` cookie used for switching the language of guests uses different settings from the Flarum cookies, and cannot be customized via `config.php` like the other cookies.

The cookie is actually defined in the frontend
https://github.com/flarum/core/blob/fa10d794a40c11d7eea321e1728879a80d397a57/js/src/forum/components/HeaderSecondary.js#L45

Meaning it's not following any of the default or custom rules used by `CookieFactory`
https://github.com/flarum/core/blob/fa10d794a40c11d7eea321e1728879a80d397a57/src/Http/CookieFactory.php#L61-L66

In particular, neither name, path or domain can be customized by site owners. Since the cookie isn't even prefixed with `flarum_`, there's a higher chance of conflict with another software, or if two Flarum installations are present in different subfolders.

I'm not sure how/if we want to fix that. If we moved the change language feature to an API/forum endpoint, we could use the `CookieFactory` on the PHP side and all of its benefits.

It's probably not a big issue, considering the defaults are quite sensible and that it won't create any issue on the large majority of forums. I noticed this while working on a solution that would allow different features of Flarum to use different subdomains, and realized I couldn't customize the cookie to be present on the top level domain to apply globally. I also noticed it's not possible to customize the SameSite value, so maybe there's also an issue with switching language inside of an iframe?

Contributor guide

Open the contributing guide

Research direction

Start with js/src/forum/components/HeaderSecondary.js around the guest locale cookie and compare its settings with src/Http/CookieFactory.php. Trace how CookieFactory settings are configured through config.php, then define completion as the locale cookie following the applicable name, path, domain, and SameSite customization rules.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, php
Domain
backend, full-stack
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.