{"record":{"id":"563ffe330ffc3cb4","repo":"symfony/http-foundation","slug":"the-samesite-parameter-value-is-not-valid","errorCode":null,"errorMessage":"The \"sameSite\" parameter value is not valid.","messagePattern":"The \"sameSite\" parameter value is not valid\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"Cookie.php","lineNumber":255,"sourceCode":"\n        return $cookie;\n    }\n\n    /**\n     * Creates a cookie copy with SameSite attribute.\n     *\n     * @param self::SAMESITE_*|''|null $sameSite\n     */\n    public function withSameSite(?string $sameSite): static\n    {\n        if ('' === $sameSite) {\n            $sameSite = null;\n        } elseif (null !== $sameSite) {\n            $sameSite = strtolower($sameSite);\n        }\n\n        if (!\\in_array($sameSite, [self::SAMESITE_LAX, self::SAMESITE_STRICT, self::SAMESITE_NONE, null], true)) {\n            throw new \\InvalidArgumentException('The \"sameSite\" parameter value is not valid.');\n        }\n\n        $cookie = clone $this;\n        $cookie->sameSite = $sameSite;\n\n        return $cookie;\n    }\n\n    /**\n     * Creates a cookie copy that is tied to the top-level site in cross-site context.\n     */\n    public function withPartitioned(bool $partitioned = true): static\n    {\n        $cookie = clone $this;\n        $cookie->partitioned = $partitioned;\n\n        return $cookie;\n    }","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Cookie.php#L237-L273","documentation":"Symfony's Cookie component validates the SameSite attribute against a fixed allow-list: 'lax', 'strict', 'none', or null. Any other string (case-insensitively lowercased first) is rejected with an InvalidArgumentException, because an invalid SameSite value would produce a cookie header browsers may ignore or treat inconsistently.","triggerScenarios":"Calling Cookie::__construct() or Cookie::create() with $sameSite set to a string other than 'lax', 'strict', 'none' (any casing), null, or '' (which is normalized to null). Also calling ->withSameSite() with e.g. 'Lax ' with trailing whitespace, 'secure', or a misspelled value.","commonSituations":"Config values passed straight from YAML/env vars (e.g. session.cookie_samesite) containing typos or stray whitespace; copying values from other frameworks like 'SameSite=Flexible' or browser-specific values; older code using 'none' without HTTPS side effects confusion.","solutions":["Use one of the class constants Cookie::SAMESITE_LAX, SAMESITE_STRICT, or SAMESITE_NONE instead of a raw string","Lowercase and trim any user/config-supplied value before passing it, and map empty string to null","Catch \\InvalidArgumentException and fall back to the default (null) when the configured value is unrecognized","Check symfony/http-foundation version docs: very old versions also lacked 'none'; upgrade if you need it"],"exampleFix":"// before\n$cookie = Cookie::create('sid', $v, 0, '/', null, true, true, false, $_ENV['COOKIE_SAMESITE'] ?? 'Lax');\n// after\n$samesite = strtolower(trim($_ENV['COOKIE_SAMESITE'] ?? ''));\n$cookie = Cookie::create('sid', $v, 0, '/', null, true, true, false,\n    in_array($samesite, ['lax', 'strict', 'none'], true) ? $samesite : Cookie::SAMESITE_LAX);","handlingStrategy":"validation","validationCode":"$allowed = [Cookie::SAMESITE_LAX, Cookie::SAMESITE_STRICT, Cookie::SAMESITE_NONE, null];\n$sameSite = null === $sameSite || '' === $sameSite ? null : strtolower(trim((string) $sameSite));\nif (!in_array($sameSite, $allowed, true)) {\n    throw new \\InvalidArgumentException(sprintf('Invalid sameSite value \"%s\"; expected lax, strict, none or null.', $sameSite));\n}","typeGuard":"function isValidSameSite(?string $v): bool {\n    return null === $v || in_array(strtolower($v), ['lax', 'strict', 'none'], true);\n}","tryCatchPattern":"try {\n    $cookie = Cookie::create('sid', $v, 0, '/', null, true, true, false, $configuredSameSite);\n} catch (\\InvalidArgumentException $e) {\n    if (str_contains($e->getMessage(), 'sameSite')) {\n        $cookie = Cookie::create('sid', $v);\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Always use the Cookie::SAMESITE_* constants instead of string literals","Trim/lowercase values coming from env vars or YAML config before passing them","Add a unit test asserting your configured SameSite value constructs a Cookie successfully","Document that empty string is normalized to null (no SameSite attribute)"],"tags":["php","symfony","cookie","samesite","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}