Fix default values for cookie flag attributes

Author: paulbalandan

system/Cookie/Cookie.php

@@ -220,15 +220,19 @@ final public function __construct(string $name, string $value = '', array $optio
 			unset($options['max-age']);
 		}
 
-		// to retain backward compatibility with previous versions' fallback
-		$prefix   = $options['prefix'] ?: self::$defaults['prefix'];
-		$path     = $options['path'] ?: self::$defaults['path'];
-		$domain   = $options['domain'] ?: self::$defaults['domain'];
-		$secure   = $options['secure'] ?: self::$defaults['secure'];
-		$httponly = $options['httponly'] ?: self::$defaults['httponly'];
+		// to preserve backward compatibility with array-based cookies in previous CI versions
+		$prefix = $options['prefix'] ?: self::$defaults['prefix'];
+		$path   = $options['path'] ?: self::$defaults['path'];
+		$domain = $options['domain'] ?: self::$defaults['domain'];
+
+		// empty string SameSite should use the default for browsers
 		$samesite = $options['samesite'] ?: self::$defaults['samesite'];
 
-		$this->validateName($name, $options['raw']);
+		$raw      = $options['raw'];
+		$secure   = $options['secure'];
+		$httponly = $options['httponly'];
+
+		$this->validateName($name, $raw);
 		$this->validatePrefix($prefix, $secure, $path, $domain);
 		$this->validateSameSite($samesite, $secure);
 
@@ -241,7 +245,7 @@ final public function __construct(string $name, string $value = '', array $optio
 		$this->secure   = $secure;
 		$this->httponly = $httponly;
 		$this->samesite = ucfirst(strtolower($samesite));
-		$this->raw      = $options['raw'];
+		$this->raw      = $raw;
 	}
 
 	//=========================================================================

tests/system/HTTP/ResponseCookieTest.php

@@ -117,9 +117,9 @@ public function testCookieHTTPOnly()
 
 		$response->setCookie('foo', 'bar');
 		$cookie = $response->getCookie('foo');
-		$this->assertTrue($cookie->isHTTPOnly());
+		$this->assertFalse($cookie->isHTTPOnly());
 
-		$response->setCookie(['name' => 'bee', 'value' => 'bop', 'httponly' => false]);
+		$response->setCookie(['name' => 'bee', 'value' => 'bop', 'httponly' => true]);
 		$cookie = $response->getCookie('bee');
 		$this->assertTrue($cookie->isHTTPOnly());
 	}