From 2bd1c5c2b94663af03ce21531b7baa36e7994a99 Mon Sep 17 00:00:00 2001 From: oppiliappan Date: Wed, 20 May 2026 10:07:46 +0100 Subject: [PATCH] appview/oauth: use SameSiteLaxMode by default Signed-off-by: oppiliappan --- appview/oauth/oauth.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/appview/oauth/oauth.go b/appview/oauth/oauth.go index d9244328..74af1873 100644 --- a/appview/oauth/oauth.go +++ b/appview/oauth/oauth.go @@ -128,6 +128,9 @@ func New(config *config.Config, ph posthog.Client, db *db.DB, enforcer *rbac.Enf } sessStore := sessions.NewCookieStore([]byte(config.Core.CookieSecret)) + sessStore.Options.SameSite = http.SameSiteLaxMode + sessStore.Options.HttpOnly = true + sessStore.Options.Secure = !config.Core.Dev clientApp := oauth.NewClientApp(&oauthConfig, authStore) clientApp.Dir = res.Directory() -- 2.51.2