diff --git a/pppr_cookie.php b/pppr_cookie.php index d35c7d2..97eef1a 100644 --- a/pppr_cookie.php +++ b/pppr_cookie.php @@ -40,13 +40,14 @@ function set_pppr_cookie($is_local, $street_name, $house_number, $postcode, $cit $signature = hash_hmac('sha256', $data_string, WP_PPPR_SALT); $cookie_value = $data_string . "|" . $signature; - $is_secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'); + $cookie_domain = $_SERVER['SERVER_NAME']; + $is_secure = is_ssl(); setcookie("PPPR", $cookie_value, [ 'expires' => time() + 7200, 'path' => '/', - 'domain' => $_SERVER['SERVER_NAME'], - 'secure' => $is_secure, // Only send over HTTPS + 'domain' => $cookie_domain, + 'secure' => $is_secure, 'httponly' => true, // Prevent JavaScript access 'samesite' => 'Lax' // Protect against CSRF ]); @@ -55,11 +56,38 @@ function set_pppr_cookie($is_local, $street_name, $house_number, $postcode, $cit function unset_pppr_cookie( $path = '/') { unset($_COOKIE["PPPR"]); - if (empty($domain)) { - setcookie("PPPR", '', time() - 3600, '/'); - } else { - setcookie("PPPR", '', time() - 3600, '/' , $_SERVER['SERVER_NAME']); + $domain = $_SERVER['SERVER_NAME']; + $is_secure = is_ssl(); + + // 3. Send the delete command with ALL matching parameters + setcookie( + "PPPR", + '', + time() - 3600, + '/', + $domain, + $is_secure, // Critical: Must match the 'secure' flag used when setting + true + ); +} + +function update_expire_pppr_cookie() { + if (!isset($_COOKIE['PPPR'])) { + return false; } + + $cookie_value = $_COOKIE['PPPR']; + $cookie_domain = $_SERVER['SERVER_NAME']; + $is_secure = is_ssl(); + + setcookie("PPPR", $cookie_value, [ + 'expires' => time() + 7200, + 'path' => '/', + 'domain' => $cookie_domain, + 'secure' => $is_secure, + 'httponly' => true, // Prevent JavaScript access + 'samesite' => 'Lax' // Protect against CSRF + ]); } function verify_pppr_cookie_string() {