Locale cookie for guests doesn't follow any of the cookie rules
- Dominant language
- No language data
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
The `locale` cookie used for switching the language of guests uses different settings from the Flarum cookies, and cannot be customized via `config.php` like the other cookies.
The cookie is actually defined in the frontend
https://github.com/flarum/core/blob/fa10d794a40c11d7eea321e1728879a80d397a57/js/src/forum/components/HeaderSecondary.js#L45
Meaning it's not following any of the default or custom rules used by `CookieFactory`
https://github.com/flarum/core/blob/fa10d794a40c11d7eea321e1728879a80d397a57/src/Http/CookieFactory.php#L61-L66
In particular, neither name, path or domain can be customized by site owners. Since the cookie isn't even prefixed with `flarum_`, there's a higher chance of conflict with another software, or if two Flarum installations are present in different subfolders.
I'm not sure how/if we want to fix that. If we moved the change language feature to an API/forum endpoint, we could use the `CookieFactory` on the PHP side and all of its benefits.
It's probably not a big issue, considering the defaults are quite sensible and that it won't create any issue on the large majority of forums. I noticed this while working on a solution that would allow different features of Flarum to use different subdomains, and realized I couldn't customize the cookie to be present on the top level domain to apply globally. I also noticed it's not possible to customize the SameSite value, so maybe there's also an issue with switching language inside of an iframe?
Contributor guide
Research direction
Start with js/src/forum/components/HeaderSecondary.js around the guest locale cookie and compare its settings with src/Http/CookieFactory.php. Trace how CookieFactory settings are configured through config.php, then define completion as the locale cookie following the applicable name, path, domain, and SameSite customization rules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, php
- Domain
- backend, full-stack
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100