PHP 7.3之前的版本

在早于PHP 7.3的PHP版本中，可以通过利用cookie路径hack来注入SameSite属性，这包括将更多cookie属性附加到路径，只需用分号关闭路径即可。
只需相应地配置app/Config/core.php中的**session.cookie_path**ini选项，例如，如果应用程序的基路径是/，则如下所示：

Configure::write('Session', [
    'defaults' => 'php',
    'ini' => [
        'session.cookie_path' => '/; SameSite=None',
    ],
]);

当您通过https访问您的站点时，CakePHP会自动配置Secure属性（即session.cookie_secure ini选项）。

从PHP 7.3开始

在PHP 7.3之前的PHP版本中，您将改用**session.cookie_samesite**ini选项：

Configure::write('Session', [
    'defaults' => 'php',
    'ini' => [
        'session.cookie_samesite' => 'None',
    ],
]);

其他Cookie

当然，所有这些都只适用于会话cookie，如果您通过the Cookie component使用额外的cookie，那么您还必须通过相应地修改$path属性来利用路径黑客，并且与会话不同，您必须显式启用安全cookie：

$this->Cookie->path = '/; SameSite=None';
$this->Cookie->secure = true;

对于PHP 7.3+，您必须使用一个自定义/扩展Cookie组件，以及一个扩展/自定义响应类，您可以在其中相应地覆盖CookieComponent::_write()、CakeResponse::cookie()和CakeResponse::_setCookies()方法，以便该组件允许为同一站点设置一个选项，并且响应将把它传递给setcookie()调用。
示例：

<?php
// in app/Controller/Component/AppCookieComponent.php

App::uses('CookieComponent', 'Controller/Component');

class AppCookieComponent extends CookieComponent
{
    public $sameSite = 'Lax';

    protected function _write($name, $value)
    {
        $this->_response->cookie(array(
            'name' => $this->name . $name,
            'value' => $this->_encrypt($value),
            'expire' => $this->_expires,
            'path' => $this->path,
            'domain' => $this->domain,
            'secure' => $this->secure,
            'httpOnly' => $this->httpOnly,
            'sameSite' => $this->sameSite,
        ));

        if (!empty($this->_reset)) {
            $this->_expires = $this->_reset;
            $this->_reset = null;
        }
    }
}

*http：//github.com/cakephp/cakephp/blob/2.3.10/lib/Cake/Controller/Component/CookieComponent.php#L413
*http：//github.com/cakephp/cakephp/blob/2.10.22/lib/Cake/Controller/Component/CookieComponent.php#L393

<?php
// in app/Network/AppResponse.php

App::uses('CakeResponse', 'Network');

class AppResponse extends CakeResponse
{
    public function cookie($options = null)
    {
        $options += [
            'sameSite' => 'Lax',
        ];

        return parent::cookie($options);
    }

    protected function _setCookies()
    {
        foreach ($this->_cookies as $name => $cookie) {
            $options = [
                'expires' => $cookie['expire'],
                'path' => $cookie['path'],
                'domain' => $cookie['domain'],
                'secure' => $cookie['secure'],
                'httponly' => $cookie['httpOnly'],
                'samesite' => $cookie['sameSite'],
            ];
            setcookie($name, $cookie['value'], $options);
        }
    }
}

*http：//github.com/cakephp/cakephp/blob/2.3.10/lib/Cake/Network/CakeResponse.php#L1189
*http：//github.com/cakephp/cakephp/blob/2.3.10/lib/Cake/Network/CakeResponse.php#L437
*http：//github.com/cakephp/cakephp/blob/2.10.22/lib/Cake/Network/CakeResponse.php#L1236
*http：//github.com/cakephp/cakephp/blob/2.10.22/lib/Cake/Network/CakeResponse.php#L454

在前端控制器中注入自定义响应：

// in app/webroot/index.php

App::uses('Network', 'AppResponse');

$Dispatcher = new Dispatcher();
$Dispatcher->dispatch(
    new CakeRequest(),
    new AppResponse()
);

*http：//github.com/cakephp/cakephp/blob/2.3.10/app/webroot/index.php#L107-L110
*http：//github.com/cakephp/cakephp/blob/2.10.22/app/webroot/index.php#L114-L118
使用自定义组件类为Cookie组件创建别名：

// in app/Controller/AppController.php

public $components = [
    'Cookie' => [
        'className' => 'AppCookie',
    ],
];

然后在使用该组件之前对其进行相应的配置：

$this->Cookie->sameSite = 'None';
$this->Cookie->secure = true;

或者直接使用响应对象来设置您的Cookie：

$this->response->cookie([
    'name' => 'cookie name',
    'value' => 'cookie value',
    'expire' => time() + (60 * 24),
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httpOnly' => false,
    'sameSite' => 'None',
]);