removed samesite check using cookie (BC break)

Author: dg

src/Bridges/HttpDI/HttpExtension.php

@@ -39,7 +39,7 @@ public function getConfigSchema(): Nette\Schema\Schema
 			'cookiePath' => Expect::string()->dynamic(),
 			'cookieDomain' => Expect::string()->dynamic(),
 			'cookieSecure' => Expect::anyOf('auto', null, true, false)->firstIsDefault()->dynamic(), // Whether the cookie is available only through HTTPS
-			'disableNetteCookie' => Expect::bool(false), // disables cookie use by Nette
+			'disableNetteCookie' => Expect::bool(false)->deprecated(),
 		]);
 	}
 
@@ -138,13 +138,6 @@ private function sendHeaders(): void
 				$this->initialization->addBody('$response->setHeader(?, ?);', [$key, $value]);
 			}
 		}
-
-		if (!$config->disableNetteCookie) {
-			$this->initialization->addBody(
-				'Nette\Http\Helpers::initCookie($this->getService(?), $response);',
-				[$this->prefix('request')],
-			);
-		}
 	}
 
 

src/Http/Helpers.php

@@ -19,9 +19,6 @@ final class Helpers
 {
 	use Nette\StaticClass;
 
-	/** @internal */
-	public const StrictCookieName = '_nss';
-
 
 	/**
 	 * Formats a date and time in the HTTP date format (RFC 7231), e.g. 'Mon, 23 Jan 1978 10:00:00 GMT'.
@@ -55,13 +52,4 @@ public static function ipMatch(string $ip, string $mask): bool
 
 		return strncmp($ip, $mask, $size === '' ? $max : (int) $size) === 0;
 	}
-
-
-	/**
-	 * Sends the strict same-site cookie used to detect same-site requests.
-	 */
-	public static function initCookie(IRequest $request, IResponse $response): void
-	{
-		$response->setCookie(self::StrictCookieName, '1', 0, '/', sameSite: IResponse::SameSiteStrict);
-	}
 }

src/Http/IRequest.php

@@ -11,7 +11,6 @@
 /**
  * HTTP request contract providing access to URL, headers, cookies, uploaded files, and body.
  * @method ?UrlImmutable getReferer() Returns the referrer URL.
- * @method bool isSameSite() Checks whether the request is coming from the same site.
  * @method bool isFrom(string|list<string>|null $site = null, string|list<string>|null $initiator = null)
  */
 interface IRequest

src/Http/Request.php

@@ -228,13 +228,6 @@ public function isSecured(): bool
 	}
 
 
-	/** @deprecated use isFrom(['same-site', 'same-origin']) */
-	public function isSameSite(): bool
-	{
-		return isset($this->cookies[Helpers::StrictCookieName]);
-	}
-
-
 	/**
 	 * Checks whether the request origin and initiator match the given Sec-Fetch-Site and Sec-Fetch-Dest values.
 	 * Falls back to the Origin header for browsers that don't send Sec-Fetch headers (Safari < 16.4).