Up to Flarum beta 13, Flarum was not setting the SameSite
attribute on cookies. This means different browers might have read them as either None
or Lax
.
Since beta 14, Flarum sets SameSite=Lax
by default.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
You can change the SameSite
value by editing config.php
, for example:
<?php return array (
'debug' => false,
'database' =>
array (
/* existing stuff */
),
'url' => 'https://example.com',
'paths' =>
array (
/* existing stuff */
),
'cookie' => [
'samesite' => 'none', // `strict` / `none`, defaults to `lax`
],
);