Set samesite lax instead of None if site is not on https (#15604)

fix https://github.com/matomo-org/matomo/issues/15598

1 files changed, 12 insertions, 10 deletions

diff --git a/core/Cookie.php b/core/Cookie.php
index 26cbfe6a3f..6cecd6de53 100644
--- a/core/Cookie.php
+++ b/core/Cookie.php
@@ -441,16 +441,18 @@ class Cookie
         $sameSite = ucfirst(strtolower($default));
 
         if ($sameSite == 'None') {
-            $userAgent = Http::getUserAgent();
-            $ddFactory = StaticContainer::get(\Piwik\DeviceDetector\DeviceDetectorFactory::class);
-            $deviceDetector = $ddFactory->makeInstance($userAgent);
-            $deviceDetector->parse();
-
-            $browserFamily = \DeviceDetector\Parser\Client\Browser::getBrowserFamily($deviceDetector->getClient('short_name'));
-            if ((!ProxyHttp::isHttps()) && $browserFamily === 'Chrome') {
-                $sameSite = 'Lax';
-            } else if ($browserFamily === 'Safari') {
-                $sameSite = '';
+            if ((!ProxyHttp::isHttps())) {
+                $sameSite = 'Lax'; // None can be only used when secure flag will be set
+            } else {
+                $userAgent = Http::getUserAgent();
+                $ddFactory = StaticContainer::get(\Piwik\DeviceDetector\DeviceDetectorFactory::class);
+                $deviceDetector = $ddFactory->makeInstance($userAgent);
+                $deviceDetector->parse();
+
+                $browserFamily = \DeviceDetector\Parser\Client\Browser::getBrowserFamily($deviceDetector->getClient('short_name'));
+                if ($browserFamily === 'Safari') {
+                    $sameSite = '';
+                }
             }
         }