fix: set same site to lax

getAlby · Jun 30, 2023 · 70e97ec · 70e97ec
1 parent f109d30
commit 70e97ec
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/alby.go b/alby.go
@@ -153,6 +153,7 @@ func (svc *AlbyOAuthService) AuthHandler(c echo.Context) error {
 	if (sess.Values["user_id"] != nil) {
 		delete(sess.Values, "user_id")
 		sess.Options.MaxAge = 0
+		sess.Options.SameSite = http.SameSiteLaxMode
 		if svc.cfg.CookieDomain != "" {
 			sess.Options.Domain = svc.cfg.CookieDomain
 		}
@@ -203,6 +204,7 @@ func (svc *AlbyOAuthService) CallbackHandler(c echo.Context) error {
 
 	sess, _ := session.Get(CookieName, c)
 	sess.Options.MaxAge = 0
+	sess.Options.SameSite = http.SameSiteLaxMode
 	if svc.cfg.CookieDomain != "" {
 		sess.Options.Domain = svc.cfg.CookieDomain
 	}

diff --git a/echo_handlers.go b/echo_handlers.go
@@ -93,6 +93,7 @@ func (svc *Service) IndexHandler(c echo.Context) error {
 	if user != nil && returnTo != nil {
 		delete(sess.Values, "return_to")
 		sess.Options.MaxAge = 0
+		sess.Options.SameSite = http.SameSiteLaxMode
 		if svc.cfg.CookieDomain != "" {
 			sess.Options.Domain = svc.cfg.CookieDomain
 		}
@@ -232,6 +233,7 @@ func (svc *Service) AppsNewHandler(c echo.Context) error {
 		sess, _ := session.Get(CookieName, c)
 		sess.Values["return_to"] = c.Path() + "?" + c.QueryString()
 		sess.Options.MaxAge = 0
+		sess.Options.SameSite = http.SameSiteLaxMode
 		if svc.cfg.CookieDomain != "" {
 			sess.Options.Domain = svc.cfg.CookieDomain
 		}