From 273eb3604adcfed515cda683cd022dbea9413d87 Mon Sep 17 00:00:00 2001
From: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Date: Sat, 16 Dec 2023 12:49:03 +0100
Subject: [PATCH] feat(cookie): use samesite lax instead of none for callback

---
 pkg/cookie/cookie.go   | 8 ++------
 pkg/handler/handler.go | 4 ++--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkg/cookie/cookie.go b/pkg/cookie/cookie.go
index d39f5da..558985f 100644
--- a/pkg/cookie/cookie.go
+++ b/pkg/cookie/cookie.go
@@ -13,7 +13,6 @@ import (
 const (
 	DefaultPrefix = "io.nais.wonderwall"
 	loginservice  = "selvbetjening-idtoken"
-	loginstatus   = "innloggingsstatus-token"
 )
 
 var (
@@ -150,7 +149,7 @@ func EncryptAndSet(w http.ResponseWriter, key, value string, opts Options, crypt
 
 func SetLegacyCookie(w http.ResponseWriter, value string, opts Options) {
 	c := Make(loginservice, value, opts.
-		WithSameSite(http.SameSiteNoneMode).
+		WithSameSite(http.SameSiteLaxMode).
 		WithPath("/"))
 	c.UnsetExpiry()
 	Set(w, c)
@@ -159,10 +158,7 @@ func SetLegacyCookie(w http.ResponseWriter, value string, opts Options) {
 func ClearLegacyCookies(w http.ResponseWriter, opts Options) {
 	// TODO - remove when legacy services are sunset and shut down
 	Clear(w, loginservice, opts.
-		WithSameSite(http.SameSiteNoneMode).
-		WithPath("/"))
-	Clear(w, loginstatus, opts.
-		WithSameSite(http.SameSiteDefaultMode).
+		WithSameSite(http.SameSiteLaxMode).
 		WithPath("/"))
 }
 
diff --git a/pkg/handler/handler.go b/pkg/handler/handler.go
index 8d11819..2a59f54 100644
--- a/pkg/handler/handler.go
+++ b/pkg/handler/handler.go
@@ -132,7 +132,7 @@ func (s *Standalone) Login(w http.ResponseWriter, r *http.Request) {
 
 	opts := s.GetCookieOptions(r).
 		WithExpiresIn(1 * time.Hour).
-		WithSameSite(http.SameSiteNoneMode)
+		WithSameSite(http.SameSiteLaxMode)
 	err = login.SetCookie(w, opts, s.Crypter, canonicalRedirect)
 	if err != nil {
 		s.InternalError(w, r, fmt.Errorf("login: setting cookie: %w", err))
@@ -177,7 +177,7 @@ func (s *Standalone) LoginCallback(w http.ResponseWriter, r *http.Request) {
 	logger := mw.LogEntryFrom(r)
 
 	// unconditionally clear login cookies
-	cookie.Clear(w, cookie.Login, opts.WithSameSite(http.SameSiteNoneMode))
+	cookie.Clear(w, cookie.Login, opts.WithSameSite(http.SameSiteLaxMode))
 	cookie.Clear(w, cookie.LoginLegacy, opts.WithSameSite(http.SameSiteDefaultMode))
 
 	loginCookie, err := openid.GetLoginCookie(r, s.Crypter)