Title: SameSite Cookies Author: Ayesh Karunaratne Published: 2019 年 5 月 2 日 Last modified: 2023 年 7 月 23 日 --- 搜尋外掛 ![](https://ps.w.org/samesite/assets/banner-772x250.jpg?rev=2155223) 這個外掛**並未在最新的 3 個 WordPress 主要版本上進行測試**。開發者可能不再對這個 外掛進行維護或提供技術支援，並可能會與更新版本的 WordPress 產生使用上的相容性問題。 ![](https://ps.w.org/samesite/assets/icon-256x256.jpg?rev=2155223) # SameSite Cookies 由 [Ayesh Karunaratne](https://profiles.wordpress.org/ayeshrajans/) 開發 [下載](https://downloads.wordpress.org/plugin/samesite.2.1.zip) * [詳細資料](https://tw.wordpress.org/plugins/samesite/#description) * [使用者評論](https://tw.wordpress.org/plugins/samesite/#reviews) * [安裝方式](https://tw.wordpress.org/plugins/samesite/#installation) * [開發資訊](https://tw.wordpress.org/plugins/samesite/#developers) [技術支援](https://wordpress.org/support/plugin/samesite/) ## 外掛說明 This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site. SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to **support all PHP versions** WordPress supports. There is no administrative UI provided: Activate this plugin, and you are all set! You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from `Lax` (default), `Strict`, or `None`. You can read about [SameSite cookies here](https://php.watch/articles/PHP-Samesite-cookies). To configure the `SameSite` flag value, edit your WordPress configuration file (` wp-config.php`), and add the following lines right above `/** Sets up WordPress vars and included files. */`. ``` define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'. ``` Note that **only the authentication cookies are affected**. Regular cookies that your installed plugins set will **not** be affected, nor provide any meaningful value with `SameSite` flags. ## 螢幕擷圖 * [[ * Browser response containing the SameSite attribute in Setcookie headers. ## 安裝方式 1. Install this plugin as you would with any other plugin. 2. Enable it. 3. There is no third step – From this point afterward, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks. If you find this plugin useful, I’d appreciate you leaving a review on the plugin page. ## 常見問題集 ### The plugin doesn’t work !?!? Yeah, probably. This plugin uses what’s called “pluggable functions” supported in WordPress to replace `wp_set_auth_cookie` function. This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does. ### How do I test if the plugin works Go to the Login page of your WordPress site, and open your browser’s development tools. Inspect the HTTP POST request made by the browser when you submit the login form. The response headers for `Setcookie` response headers must contain `Samesite =Lax` (or the configured value) if the plugin is working. Note that cookies apart from the authentication cookies are **not** handled by this plugin, nor it makes sense to add SameSite attribute to them. See the screenshot as well. ### Do I need to have PHP 7.3 or later? No. [PHP 7.3 officially added SameSite cookie support](https://php.watch/versions/7.3/same-site-cookies), but this plugin comes with a polyfill to extend support to all previous PHP versions. ### Is WordPress vulnerable to CSRF attacks without this plugin? Without SameSite cookie, WordPress core and third party plugins must implement their own CSRF checks, which can be overlooked, [intentionally ignored](https://wordpress.org/plugins/comment-form-csrf-protection/), or sometimes not even have thought about, which can be the case for contributed plugin. This plugin attempts to solve this with different take and complement existing solutions. ## 使用者評論 ![](https://secure.gravatar.com/avatar/3f08ba3325909ad31dca12032899b52d3ee5c4a7a7e92aca5c216ded95bceba0? s=60&d=retro&r=g) ### 󠀁[2024 This plugin DOES work.](https://wordpress.org/support/topic/2024-%e2%86%92-this-plugin-does-work/)󠁿 [Fer](https://profiles.wordpress.org/ferfactory/) 2024 年 5 月 14 日 Looks like nobody read the FAQ: The plugin doesn’t work !?!? Yeah, probably. This plugin uses what’s called “pluggable functions” supported in WordPress to replace wp_set_auth_cookie function.This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does. In my case, the issue was with the plugin WPS Hide Login. Disable that other plugin and this plugin worked correctly.EDIT: In case you still want to change the login URL, use the plugin Admin login URL Change. ![](https://secure.gravatar.com/avatar/16565b2baf17499a0d6bb1d111ae2480238987e5f414eea2bec5facedd13b4e9? s=60&d=retro&r=g) ### 󠀁[The plugin doesn’t work](https://wordpress.org/support/topic/the-plugin-doesnt-work-43/)󠁿 [tranhoang](https://profiles.wordpress.org/tranhoang/) 2021 年 7 月 16 日 I don’t know why the Author created this plugin, It does not work, please remove it from the plugin library ![](https://secure.gravatar.com/avatar/93af0c8ae062b5b3efc426e8585ebe23a4d762d8104f55fa9229be717720274c? s=60&d=retro&r=g) ### 󠀁[Wasted two days on this](https://wordpress.org/support/topic/wasted-two-days-on-this/)󠁿 [Rab Nawaz](https://profiles.wordpress.org/rnawaz02/) 2020 年 9 月 15 日 It does not work ![](https://secure.gravatar.com/avatar/bf350b03ea89f10db47db197e1408fd185647cbf5a9b9f5e6c4ea832196c1199? s=60&d=retro&r=g) ### 󠀁[it’s works](https://wordpress.org/support/topic/its-works-26/)󠁿 [ramazan12345](https://profiles.wordpress.org/ramazan12345/) 2020 年 4 月 5 日 Chrome was showing an error from the developer console. Errors disappeared when I installed this plugin. The plugin is working and problem-free. thank you ![](https://secure.gravatar.com/avatar/e77da3eb386c984ca5995a2e33dd3a98474f68c6dfb7c4d90a9fda10abc24be6? s=60&d=retro&r=g) ### 󠀁[It could work…](https://wordpress.org/support/topic/works-like-a-charm-1645/)󠁿 [pypmaker](https://profiles.wordpress.org/pypmaker/) 2020 年 3 月 4 日 It sorted out my problem. And created another – I can’t log into my site with this plugin installed! Unfortunately…. ![](https://secure.gravatar.com/avatar/7cbb07de535853152e3d55e4a218fd4deb60d726f0d39a66509a3fce6e7c2de8? s=60&d=retro&r=g) ### 󠀁[This plugin does not work](https://wordpress.org/support/topic/this-plugin-does-not-work-33/)󠁿 [nissimboozaglo](https://profiles.wordpress.org/nissimboozaglo/) 2020 年 1 月 29 日 This plugin does not work for me. In addition, after I installed it, I could not log back in to the WordPress backend. Had to disable the plugin through WP Engine to gain back the access. waste of time. [ 閱讀全部 11 則使用者評論 ](https://wordpress.org/support/plugin/samesite/reviews/) ## 參與者及開發者 以下人員參與了開源軟體〈SameSite Cookies〉的開發相關工作。 參與者 * [ Ayesh Karunaratne ](https://profiles.wordpress.org/ayeshrajans/) 〈SameSite Cookies〉外掛目前已有 1 個本地化語言版本。 感謝[全部譯者](https://translate.wordpress.org/projects/wp-plugins/samesite/contributors) 為這個外掛做出的貢獻。 [將〈SameSite Cookies〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/samesite) ### 對開發相關資訊感興趣？ 任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/samesite/)、查看 [SVN 存放庫](https://plugins.svn.wordpress.org/samesite/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/samesite/?limit=100&mode=stop_on_copy&format=rss) 訂閱[開發記錄](https://plugins.trac.wordpress.org/log/samesite/)。 ## 變更記錄 #### 1.5 * Fixes a cookie expiration issue that was reported multiple times in the issue queue. Thanks to Jamie Magin (@jamagin at GitHub). #### 2.0 * Requires PHP 7.0+ * Requires WordPress 6.2+ * Synced pluggable code from upstream for better compatibility with hooks. #### 2.1 * Minor readme.txt updates ## 中繼資料 * 版本 **2.1** * 最後更新 **3 年前** * 啟用安裝數 **800+** * WordPress 版本需求 ** 6.2 或更新版本 ** * 已測試相容的 WordPress 版本 **6.3.8** * PHP 版本需求 ** 7.0 或更新版本 ** * 語言 * [English (US)](https://wordpress.org/plugins/samesite/) 及 [Norwegian (Bokmål)](https://nb.wordpress.org/plugins/samesite/). * [將這個外掛本地化為你的母語版本](https://translate.wordpress.org/projects/wp-plugins/samesite) * 標籤 * [cookies](https://tw.wordpress.org/plugins/tags/cookies/)[csrf](https://tw.wordpress.org/plugins/tags/csrf/) [samesite](https://tw.wordpress.org/plugins/tags/samesite/)[security](https://tw.wordpress.org/plugins/tags/security/) * [進階檢視](https://tw.wordpress.org/plugins/samesite/advanced/) ## 評分 2.5 星，滿分為 5 星 * [ 4 個 5 星使用者評論 ](https://wordpress.org/support/plugin/samesite/reviews/?filter=5) * [ 0 個 4 星使用者評論 ](https://wordpress.org/support/plugin/samesite/reviews/?filter=4) * [ 0 個 3 星使用者評論 ](https://wordpress.org/support/plugin/samesite/reviews/?filter=3) * [ 1 個 2 星使用者評論 ](https://wordpress.org/support/plugin/samesite/reviews/?filter=2) * [ 6 個 1 星使用者評論 ](https://wordpress.org/support/plugin/samesite/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/samesite/reviews/#new-post) [查看全部使用者評論](https://wordpress.org/support/plugin/samesite/reviews/) ## 參與者 * [ Ayesh Karunaratne ](https://profiles.wordpress.org/ayeshrajans/) ## 技術支援 使用者可在技術支援論壇提出意見反應或使用問題。 [檢視技術支援論壇](https://wordpress.org/support/plugin/samesite/)