From e7db6df5eacb3cf154aecc622d9c2e642055052a Mon Sep 17 00:00:00 2001
From: Michael Geers <michael@geers.tv>
Date: Tue, 14 May 2024 07:45:18 +0200
Subject: [PATCH] Auth: strict same site header (#13896)

---
 server/http_auth.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/http_auth.go b/server/http_auth.go
index bd12e8349..160bd2ebd 100644
--- a/server/http_auth.go
+++ b/server/http_auth.go
@@ -114,6 +114,7 @@ func loginHandler(auth auth.Auth) http.HandlerFunc {
 			Path:     "/",
 			HttpOnly: true,
 			Expires:  time.Now().Add(lifetime),
+			SameSite: http.SameSiteStrictMode,
 		})
 	}
 }