feature #15372 [FrameworkBundle] Change the default value of cookie_httponly (jderusse)

This PR was merged into the 2.8 branch.

Discussion
----------

[FrameworkBundle] Change the default value of cookie_httponly

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | yes
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #15303
| License       | MIT
| Doc PR        | symfony/symfony-docs#5561

Commits
-------

a7bef1e Change the default value of cookie_httponly to fix #15303

Author: fabpot

DependencyInjection/Configuration.php

@@ -340,7 +340,7 @@ private function addSessionSection(ArrayNodeDefinition $rootNode)
                         ->scalarNode('cookie_path')->end()
                         ->scalarNode('cookie_domain')->end()
                         ->booleanNode('cookie_secure')->end()
-                        ->booleanNode('cookie_httponly')->end()
+                        ->booleanNode('cookie_httponly')->defaultTrue()->end()
                         ->scalarNode('gc_divisor')->end()
                         ->scalarNode('gc_probability')->defaultValue(1)->end()
                         ->scalarNode('gc_maxlifetime')->end()

Tests/DependencyInjection/Fixtures/php/full.php

@@ -32,7 +32,7 @@
         'cookie_path' => '/',
         'cookie_domain' => 'example.com',
         'cookie_secure' => true,
-        'cookie_httponly' => true,
+        'cookie_httponly' => false,
         'gc_maxlifetime' => 90000,
         'gc_divisor' => 108,
         'gc_probability' => 1,

Tests/DependencyInjection/Fixtures/xml/full.xml

@@ -14,7 +14,7 @@
         <framework:esi enabled="true" />
         <framework:profiler only-exceptions="true" enabled="false" />
         <framework:router resource="%kernel.root_dir%/config/routing.xml" type="xml" />
-        <framework:session gc-maxlifetime="90000" gc-probability="1" gc-divisor="108" storage-id="session.storage.native" handler-id="session.handler.native_file" name="_SYMFONY" cookie-lifetime="86400" cookie-path="/" cookie-domain="example.com" cookie-secure="true" cookie-httponly="true" save-path="/path/to/sessions" />
+        <framework:session gc-maxlifetime="90000" gc-probability="1" gc-divisor="108" storage-id="session.storage.native" handler-id="session.handler.native_file" name="_SYMFONY" cookie-lifetime="86400" cookie-path="/" cookie-domain="example.com" cookie-secure="true" cookie-httponly="false" save-path="/path/to/sessions" />
         <framework:request>
             <framework:format name="csv">
                 <framework:mime-type>text/csv</framework:mime-type>

Tests/DependencyInjection/Fixtures/yml/full.yml

@@ -24,7 +24,7 @@ framework:
         cookie_path:      /
         cookie_domain:    example.com
         cookie_secure:    true
-        cookie_httponly:  true
+        cookie_httponly:  false
         gc_probability:  1
         gc_divisor:      108
         gc_maxlifetime:  90000

Tests/DependencyInjection/FrameworkExtensionTest.php

@@ -149,7 +149,7 @@ public function testSession()
         $this->assertEquals('/', $options['cookie_path']);
         $this->assertEquals('example.com', $options['cookie_domain']);
         $this->assertTrue($options['cookie_secure']);
-        $this->assertTrue($options['cookie_httponly']);
+        $this->assertFalse($options['cookie_httponly']);
         $this->assertEquals(108, $options['gc_divisor']);
         $this->assertEquals(1, $options['gc_probability']);
         $this->assertEquals(90000, $options['gc_maxlifetime']);