From 74999305b6045da29eb9346b500d7b84e5ff908e Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Wed, 16 Aug 2023 12:50:44 -0500
Subject: [PATCH] fix: change oauth convert oidc cookie to SameSite=Lax (#9129)

The strict mode was blocking the cookie from being sent on the
redirect flow. This worked on localhost because cookies
behave differently on localhost
---
 coderd/userauth.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/coderd/userauth.go b/coderd/userauth.go
index a61b6d126d..1ea28efede 100644
--- a/coderd/userauth.go
+++ b/coderd/userauth.go
@@ -184,7 +184,9 @@ func (api *API) postConvertLoginType(rw http.ResponseWriter, r *http.Request) {
 		Expires:  claims.ExpiresAt.Time,
 		Secure:   api.SecureAuthCookie,
 		HttpOnly: true,
-		SameSite: http.SameSiteStrictMode,
+		// Must be SameSite to work on the redirected auth flow from the
+		// oauth provider.
+		SameSite: http.SameSiteLaxMode,
 	})
 	httpapi.Write(ctx, rw, http.StatusCreated, codersdk.OAuthConversionResponse{
 		StateString: stateString,