Add SameSite setting for cookies

[zeripath]

Add SameSite setting for cookies and rationalise the cookie setting code. Switches SameSite to Lax by default.

There is a possible future extension of differentiating which cookies could be set at Strict by default but that is for a future PR.

Fix #5583

Signed-off-by: Andrew Thornton [email protected]

[zeripath]

Please check and test I've set these correctly - I am by no means certain I've set these right.

There are also multiple places where we essentially have the same code duplicated multiple times so we should really do a small refactor sorting this out.

I've also taken the liberty of removing the crazy 1<<31-1 time from the lang attribute from the bottom menu. Removed as per comments

[zeripath]

I've marked this as 1.14 as I suspect that between 1.14 being released and 1.15 being released we may find ourselves in a situation whereby this is forced upon us.

Better to put it in now than later.

[6543]

@zeripath panic: session.Options.SameSite: readUint64: unexpected character: , error found in #10 byte of ...|ameSite":"strict"}|..., bigger context ...|ime":86400,"Secure":false,"Domain":"","SameSite":"strict"}|...

[lafriks]

It should also set path to cookies already does

[codecov-io]

Codecov Report

Merging #14900 (f9dec41) into master (f4efa10) will decrease coverage by 0.00%.
The diff coverage is 29.68%.

@@            Coverage Diff             @@
##           master   #14900      +/-   ##
==========================================
- Coverage   42.09%   42.09%   -0.01%     
==========================================
  Files         774      774              
  Lines       82796    82834      +38     
==========================================
+ Hits        34853    34866      +13     
- Misses      42269    42294      +25     
  Partials     5674     5674              

Impacted Files	Coverage Δ
modules/auth/sso/sso.go	21.87% <0.00%> (-5.05%)	⬇️
modules/web/middleware/locale.go	52.17% <0.00%> (-18.42%)	⬇️
routers/user/auth_openid.go	0.00% <0.00%> (ø)
modules/context/auth.go	21.18% <33.33%> (+1.00%)	⬆️
routers/user/auth.go	12.20% <41.17%> (ø)
modules/setting/session.go	78.57% <50.00%> (-11.43%)	⬇️
modules/context/context.go	65.62% <100.00%> (+0.29%)	⬆️
routers/user/setting/profile.go	40.00% <100.00%> (ø)
modules/util/timer.go	85.71% <0.00%> (-14.29%)	⬇️
modules/queue/workerpool.go	58.77% <0.00%> (-1.23%)	⬇️
... and 6 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f4efa10...f9dec41. Read the comment docs.

[zeripath]

@CirnoT I recall you had thoughts on defaulting to strict and that we should be defaulting to lax?

[zeripath]

Just need to ensure that strict is the right default I have a feeling we should have lax actually

[zeripath]

Yup we should default to lax

[CirnoT]

Certain cookies such as flash messages or transient session (2FA state, CAPTCHA or w/e) ones can be Strict as they refer to a single observed browsing session. The only one that needs to be Lax is the logon session.

[zeripath]

OK well I think we can differentiate the few other cookies later. I think setting everything to lax for the moment is going to be correct enough.