Zac Bergquist 68ce4750b1 Explicitly set the session cookie to SameSite=Lax (#50097) ...

Prior to this change, we were not explicitly setting the SameSite
mode for our session cookie, which leaves the behavior up to the
browser.

Chromium-based browsers have been defaulting to SameSite=Lax since
Chrome 80 in February 2020, so this is not a behavior change but
rather locking in today's behavior and being explicit about it.

Note that this is for Teleport's session cookie only. App session
cookies remain using SameSite=None because the proxied app may
itself be using SSO, and we need the app session cookie to make
its way through SSO redirects.

2024-12-11 22:14:32 +00:00

..

cookie_test.go

Explicitly set the session cookie to SameSite=Lax (#50097)

2024-12-11 22:14:32 +00:00

cookie.go

Explicitly set the session cookie to SameSite=Lax (#50097)

2024-12-11 22:14:32 +00:00