From 135ce1d54613778b58800627fbcedc3e64c64e24 Mon Sep 17 00:00:00 2001
From: Julien Voisin <jvoisin@users.noreply.github.com>
Date: Wed, 9 Jul 2025 04:20:24 +0200
Subject: [PATCH] feat(cookie): use `SameSiteStrictMode` when not using
 OAuth2/OIDC

---
 internal/http/cookie/cookie.go | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/internal/http/cookie/cookie.go b/internal/http/cookie/cookie.go
index 94380274..ae3988b6 100644
--- a/internal/http/cookie/cookie.go
+++ b/internal/http/cookie/cookie.go
@@ -18,20 +18,26 @@ const (
 
 // New creates a new cookie.
 func New(name, value string, isHTTPS bool, path string) *http.Cookie {
-	return &http.Cookie{
+	cookie := &http.Cookie{
 		Name:     name,
 		Value:    value,
 		Path:     basePath(path),
 		Secure:   isHTTPS,
 		HttpOnly: true,
 		Expires:  time.Now().Add(time.Duration(config.Opts.CleanupRemoveSessionsDays()) * 24 * time.Hour),
-		SameSite: http.SameSiteLaxMode,
+		SameSite: http.SameSiteStrictMode,
 	}
+
+	// OAuth doesn't work when cookies are in strict mode.
+	if config.Opts.OAuth2Provider() != "" {
+		cookie.SameSite = http.SameSiteLaxMode
+	}
+	return cookie
 }
 
 // Expired returns an expired cookie.
 func Expired(name string, isHTTPS bool, path string) *http.Cookie {
-	return &http.Cookie{
+	cookie := &http.Cookie{
 		Name:     name,
 		Value:    "",
 		Path:     basePath(path),
@@ -39,8 +45,14 @@ func Expired(name string, isHTTPS bool, path string) *http.Cookie {
 		HttpOnly: true,
 		MaxAge:   -1,
 		Expires:  time.Date(1970, 1, 1, 0, 0, 0, 0, time.UTC),
-		SameSite: http.SameSiteLaxMode,
+		SameSite: http.SameSiteStrictMode,
 	}
+
+	// OAuth doesn't work when cookies are in strict mode.
+	if config.Opts.OAuth2Provider() != "" {
+		cookie.SameSite = http.SameSiteLaxMode
+	}
+	return cookie
 }
 
 func basePath(path string) string {