Magento 2: Failed to set ini option “session.cookie_samesite” to value “Lax” when updating to - 2.3.6-p1

Question

We're working on updating to Magento 2.3.6-p1. Everything runs and builds properly, but we're getting an error report as well as an error logged in our System.log.

The error it's throwing is in line 630 of /vendor/magento/framework/Session/SessionManager.php

report.ERROR: Failed to set ini option "session.cookie_samesite" to value "Lax".

Here's the Method:

private function initIniOptions()
{
    $result = ini_set('session.use_only_cookies', '1');
    if ($result === false) {
        $error = error_get_last();
        throw new \InvalidArgumentException(
            sprintf('Failed to set ini option session.use_only_cookies to value 1. %s', $error['message'])
        );
    }

    foreach ($this->sessionConfig->getOptions() as $option => $value) {
        if ($option=='session.save_handler') {
            continue;
        } else {
            $result = ini_set($option, $value);
            if ($result === false) {
                $error = error_get_last();
                throw new \InvalidArgumentException(
                    sprintf('Failed to set ini option "%s" to value "%s". %s', $option, $value, $error['message'])
                );
            }
        }
    }
}

Has anyone run into this yet?

Answer 1

The session.cookie_samesite PHP INI is available starting from PHP 7.3. If you're getting this error, it's because you are not running PHP 7.3 or above and Magento code you run is not compatible/buggy with your older PHP version.

Answer 2

I think this issue is related to your problem: https://github.com/magento/magento2/issues/26377

On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies.

The SameSite update will require website owners to explicitly state label the third-party cookies that can be used on other sites. Cookies without the proper labelling won’t work in the Chrome browser, which has 63.62% of the overall browser market, according to Statcounter.

Right now, the Chrome SameSite cookie default is: “None,” which allows third-party cookies to track users across sites. But from February, cookies will default into “SameSite=Lax,” which means cookies are only set when the domain in the URL of the browser matches the domain of the cookie — a first-party cookie.

I've not faced this issue but in the thread you can try some of the proposed fixes like the one in https://github.com/Veriteworks/CookieFix