feat(cookie): use samesite lax instead of none for callback

pkg/cookie/cookie.go

@@ -13,7 +13,6 @@ import (
 const (
 	DefaultPrefix = "io.nais.wonderwall"
 	loginservice  = "selvbetjening-idtoken"
-	loginstatus   = "innloggingsstatus-token"
 )
 
 var (
@@ -150,7 +149,7 @@ func EncryptAndSet(w http.ResponseWriter, key, value string, opts Options, crypt
 
 func SetLegacyCookie(w http.ResponseWriter, value string, opts Options) {
 	c := Make(loginservice, value, opts.
-		WithSameSite(http.SameSiteNoneMode).
+		WithSameSite(http.SameSiteLaxMode).
 		WithPath("/"))
 	c.UnsetExpiry()
 	Set(w, c)
@@ -159,10 +158,7 @@ func SetLegacyCookie(w http.ResponseWriter, value string, opts Options) {
 func ClearLegacyCookies(w http.ResponseWriter, opts Options) {
 	// TODO - remove when legacy services are sunset and shut down
 	Clear(w, loginservice, opts.
-		WithSameSite(http.SameSiteNoneMode).
-		WithPath("/"))
-	Clear(w, loginstatus, opts.
-		WithSameSite(http.SameSiteDefaultMode).
+		WithSameSite(http.SameSiteLaxMode).
 		WithPath("/"))
 }
 

pkg/handler/handler.go

@@ -132,7 +132,7 @@ func (s *Standalone) Login(w http.ResponseWriter, r *http.Request) {
 
 	opts := s.GetCookieOptions(r).
 		WithExpiresIn(1 * time.Hour).
-		WithSameSite(http.SameSiteNoneMode)
+		WithSameSite(http.SameSiteLaxMode)
 	err = login.SetCookie(w, opts, s.Crypter, canonicalRedirect)
 	if err != nil {
 		s.InternalError(w, r, fmt.Errorf("login: setting cookie: %w", err))
@@ -177,7 +177,7 @@ func (s *Standalone) LoginCallback(w http.ResponseWriter, r *http.Request) {
 	logger := mw.LogEntryFrom(r)
 
 	// unconditionally clear login cookies
-	cookie.Clear(w, cookie.Login, opts.WithSameSite(http.SameSiteNoneMode))
+	cookie.Clear(w, cookie.Login, opts.WithSameSite(http.SameSiteLaxMode))
 	cookie.Clear(w, cookie.LoginLegacy, opts.WithSameSite(http.SameSiteDefaultMode))
 
 	loginCookie, err := openid.GetLoginCookie(r, s.Crypter)