Set cookies to SameSiteStrictMode, set OAuth cookie to SameSiteLaxMode

Author: Forceu

internal/webserver/authentication/csrftoken/CsrfToken.go

@@ -14,8 +14,8 @@ var cleanupOnce sync.Once
 const ttl = 5 * time.Minute
 
 const (
-	TypeLogin = iota
-	TypeApiToken
+	TypeLogin    = iota
+	TypeApiToken // currently not used
 )
 
 type csrfToken struct {
@@ -45,7 +45,7 @@ func IsValid(tokenType int, tokenId string) bool {
 	if !ok {
 		return false
 	}
-	delete(tokens, tokenId)
+	delete(tokens, tokenId) //always deletes token, even if it was wrong type
 	if token.Type != tokenType {
 		return false
 	}

internal/webserver/authentication/oauth/Oauth.go

@@ -119,6 +119,7 @@ func setCallbackCookie(w http.ResponseWriter, value string) {
 		Value:    value,
 		MaxAge:   int(time.Hour.Seconds()),
 		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
 	}
 	http.SetCookie(w, c)
 }

internal/webserver/authentication/sessionmanager/SessionManager.go

@@ -88,7 +88,7 @@ func writeSessionCookie(w http.ResponseWriter, sessionString string, expiry time
 		Value:    sessionString,
 		Expires:  expiry,
 		HttpOnly: true,
-		SameSite: http.SameSiteLaxMode,
+		SameSite: http.SameSiteStrictMode,
 	}
 	http.SetCookie(w, c)
 }