General developer forum

Hey Joaquín!

Strange! I did manage to fix my PHP 7.3 troubles, but it sounds like you've got something else going on. 

Some ideas:

MAYBE NOT AN IFRAME AFTER ALL

Reading through your original question again, I'm actually not sure if the iframe solution is your best move here. It might be simpler to add a redirect through your server.

If you're running Apache, you can do a mod_rewrite in an .htaccess file in domain/folder: https://stackoverflow.com/questions/31324928/redirecting-from-one-domain-to-another-with-mod-rewrite?rq=1. If you're running nginx, there's this: https://www.digitalocean.com/community/questions/enabling-nginx-mod_rewrite. If you're running something else, you can prolly Google for the mod_rewrite equivalent and figure it out from there. =) If you do it correctly, you won't need to embed Moodle in an iframe at all, and the end user won't know the difference.

1. The session starts in start()
2. prepare_cookies is called in start(), and because you're on PHP 7.1, session_set_cookie_params is called on line 314 properly for PHP 7.1 (which doesn't allow for the array of options signature; that didn't show up until 7.3; see the changelog on https://www.php.net/manual/en/function.session-set-cookie-params.php), and samesite isn't addressed at all in the session_set_cookies_params call.
3. A few lines later in start(), initialise_user_session gets called, and at the end of that function, the hack that was added for Moodle 3.8.2 gets called: append_samesite_cookie_attribute. This is what Moodle uses to append the samesite attribute onto cookies for PHP versions less than 7.3.
4. append_samesite_cookie_attribute checks to make sure the samesite stuff is necessary by checking should_use_samesite_none, and if it is, it appends "; SameSite=None" to the Set-Cookie header for all session_name() cookies.

So your problem would be somewhere in that sequence—perhaps should_use_samesite_none is returning false because you aren't using secure cookies? You can make sure secure cookies are on in admin/settings.php?section=httpsecurity (they're on by default). You should also check your php.ini, which is how I solved my problem.

HOW I FIXED MY PROBLEM (PHP 7.3)

Even tho my fix for my issue was for PHP 7.3, it might also be relevant/helpful for you (or for anybody else reading this after a Google!). From what I understand, your session.cookie settings in local or main php.ini files override whatever you set through script for individual cookies (reference), so session variables you set there would override Moodle's settings and attempts.

So in your case, you'd want to make sure something in your php.ini isn't overriding secure cookies by setting session.cookie_secure to 0 or Off. If you want to ensure secure cookies, you'd put this in your php.ini:

session.cookie_secure = 1

In my case, the problem was with session.cookie_samesite (only available in >= PHP 7.3) in a main php.ini file, where it was being set like this:

session.cookie_samesite = None

and needed to be set like this:

session.cookie_samesite = "None"

Because none without quotes means false in PHP ini files, and if you set it to false, you're unsetting it, which makes PHP not send the samesite attribute at all, and Chrome 80+ assumes that a missing samesite attribute means samesite=Lax  ¯\_(ツ)_/¯ (reference).

***

Hope something in all that helps! =) The tl;dr: don't mess with manager.php, revert any changes you made there, maybe look into doing a mod_rewrite redirect instead of serving Moodle in an iframe, and if that isn't an option for some reason, check your php.ini files.