symfony/http-foundation · error · InvalidArgumentException

The "sameSite" parameter value is not valid.

Error message

The "sameSite" parameter value is not valid.

What it means

Symfony's Cookie component validates the SameSite attribute against a fixed allow-list: 'lax', 'strict', 'none', or null. Any other string (case-insensitively lowercased first) is rejected with an InvalidArgumentException, because an invalid SameSite value would produce a cookie header browsers may ignore or treat inconsistently.

Solutions

1. Use one of the class constants Cookie::SAMESITE_LAX, SAMESITE_STRICT, or SAMESITE_NONE instead of a raw string
2. Lowercase and trim any user/config-supplied value before passing it, and map empty string to null
3. Catch \InvalidArgumentException and fall back to the default (null) when the configured value is unrecognized
4. Check symfony/http-foundation version docs: very old versions also lacked 'none'; upgrade if you need it

Example fix

// before
$cookie = Cookie::create('sid', $v, 0, '/', null, true, true, false, $_ENV['COOKIE_SAMESITE'] ?? 'Lax');
// after
$samesite = strtolower(trim($_ENV['COOKIE_SAMESITE'] ?? ''));
$cookie = Cookie::create('sid', $v, 0, '/', null, true, true, false,
    in_array($samesite, ['lax', 'strict', 'none'], true) ? $samesite : Cookie::SAMESITE_LAX);

$allowed = [Cookie::SAMESITE_LAX, Cookie::SAMESITE_STRICT, Cookie::SAMESITE_NONE, null];
$sameSite = null === $sameSite || '' === $sameSite ? null : strtolower(trim((string) $sameSite));
if (!in_array($sameSite, $allowed, true)) {
    throw new \InvalidArgumentException(sprintf('Invalid sameSite value "%s"; expected lax, strict, none or null.', $sameSite));
}

function isValidSameSite(?string $v): bool {
    return null === $v || in_array(strtolower($v), ['lax', 'strict', 'none'], true);
}

try {
    $cookie = Cookie::create('sid', $v, 0, '/', null, true, true, false, $configuredSameSite);
} catch (\InvalidArgumentException $e) {
    if (str_contains($e->getMessage(), 'sameSite')) {
        $cookie = Cookie::create('sid', $v);
    } else {
        throw $e;
    }
}

When it happens

Trigger: Calling Cookie::__construct() or Cookie::create() with $sameSite set to a string other than 'lax', 'strict', 'none' (any casing), null, or '' (which is normalized to null). Also calling ->withSameSite() with e.g. 'Lax ' with trailing whitespace, 'secure', or a misspelled value.

Common situations: Config values passed straight from YAML/env vars (e.g. session.cookie_samesite) containing typos or stray whitespace; copying values from other frameworks like 'SameSite=Flexible' or browser-specific values; older code using 'none' without HTTPS side effects confusion.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• The cookie name " " uses a reserved prefix, which requires…
• The cookie name " " uses the "__Host-" prefix, which…
• The cookie name " " uses the "__Host-" prefix, which…
• You cannot guess the extension as the Mime component is not…
• The disposition must be either

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/563ffe330ffc3cb4. Report an issue: GitHub.

Appendix: source

Thrown at Cookie.php:255

        return $cookie;
    }

    /**
     * Creates a cookie copy with SameSite attribute.
     *
     * @param self::SAMESITE_*|''|null $sameSite
     */
    public function withSameSite(?string $sameSite): static
    {
        if ('' === $sameSite) {
            $sameSite = null;
        } elseif (null !== $sameSite) {
            $sameSite = strtolower($sameSite);
        }

        if (!\in_array($sameSite, [self::SAMESITE_LAX, self::SAMESITE_STRICT, self::SAMESITE_NONE, null], true)) {
            throw new \InvalidArgumentException('The "sameSite" parameter value is not valid.');
        }

        $cookie = clone $this;
        $cookie->sameSite = $sameSite;

        return $cookie;
    }

    /**
     * Creates a cookie copy that is tied to the top-level site in cross-site context.
     */
    public function withPartitioned(bool $partitioned = true): static
    {
        $cookie = clone $this;
        $cookie->partitioned = $partitioned;

        return $cookie;
    }

View on GitHub (pinned to 5aea19cd67)