From a5d8b51672279803e77a435dc8c84b7cc58c0e75 Mon Sep 17 00:00:00 2001
From: Bharat Rajani <bharat.ramrajani@gmail.com>
Date: Sun, 21 Apr 2024 22:28:54 +0530
Subject: [PATCH 1/2] fix no default samesite

---
 .gitignore       | 4 ++++
 sessions_test.go | 9 +++++++++
 store.go         | 5 +++--
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 84039fe..409a25f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,5 @@
 coverage.coverprofile
+
+# IDE Metadata
+.idea
+.vscode
diff --git a/sessions_test.go b/sessions_test.go
index ddba006..0d39375 100644
--- a/sessions_test.go
+++ b/sessions_test.go
@@ -9,6 +9,7 @@ import (
 	"encoding/gob"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 )
 
@@ -39,6 +40,10 @@ func TestFlashes(t *testing.T) {
 
 	store := NewCookieStore([]byte("secret-key"))
 
+	if store.Options.SameSite != http.SameSiteLaxMode {
+		t.Fatalf("cookie store error: default same site is not set to Lax")
+	}
+
 	// Round 1 ----------------------------------------------------------------
 
 	req, _ = http.NewRequest("GET", "http://localhost:8080/", nil)
@@ -67,6 +72,10 @@ func TestFlashes(t *testing.T) {
 		t.Fatal("No cookies. Header:", hdr)
 	}
 
+	if !strings.Contains(cookies[0], "SameSite=Lax") {
+		t.Fatal("Set-Cookie does not contains SameSite=Lax, cookie string:", cookies[0])
+	}
+
 	if _, err = store.Get(req, "session:key"); err.Error() != "sessions: invalid character in cookie name: session:key" {
 		t.Fatalf("Expected error due to invalid cookie name")
 	}
diff --git a/store.go b/store.go
index 68d4ce5..bc75936 100644
--- a/store.go
+++ b/store.go
@@ -54,8 +54,9 @@ func NewCookieStore(keyPairs ...[]byte) *CookieStore {
 	cs := &CookieStore{
 		Codecs: securecookie.CodecsFromPairs(keyPairs...),
 		Options: &Options{
-			Path:   "/",
-			MaxAge: 86400 * 30,
+			Path:     "/",
+			MaxAge:   86400 * 30,
+			SameSite: http.SameSiteLaxMode,
 		},
 	}
 

From 48890fdaf10f8b565743f8651ee226bc1b696116 Mon Sep 17 00:00:00 2001
From: Bharat Rajani <bharat.ramrajani@gmail.com>
Date: Thu, 25 Apr 2024 11:50:25 +0530
Subject: [PATCH 2/2] address review comments

---
 .gitignore           | 4 ----
 cookie_go111_test.go | 1 +
 sessions_test.go     | 8 ++++----
 store.go             | 3 ++-
 4 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index 409a25f..84039fe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1 @@
 coverage.coverprofile
-
-# IDE Metadata
-.idea
-.vscode
diff --git a/cookie_go111_test.go b/cookie_go111_test.go
index e6137c7..2fad2e7 100644
--- a/cookie_go111_test.go
+++ b/cookie_go111_test.go
@@ -17,6 +17,7 @@ func TestNewCookieFromOptionsSameSite(t *testing.T) {
 		{http.SameSiteDefaultMode},
 		{http.SameSiteLaxMode},
 		{http.SameSiteStrictMode},
+		{http.SameSiteNoneMode},
 	}
 	for i, v := range tests {
 		options := &Options{
diff --git a/sessions_test.go b/sessions_test.go
index 0d39375..9476c22 100644
--- a/sessions_test.go
+++ b/sessions_test.go
@@ -40,8 +40,8 @@ func TestFlashes(t *testing.T) {
 
 	store := NewCookieStore([]byte("secret-key"))
 
-	if store.Options.SameSite != http.SameSiteLaxMode {
-		t.Fatalf("cookie store error: default same site is not set to Lax")
+	if store.Options.SameSite != http.SameSiteNoneMode {
+		t.Fatalf("cookie store error: default same site is not set to None")
 	}
 
 	// Round 1 ----------------------------------------------------------------
@@ -72,8 +72,8 @@ func TestFlashes(t *testing.T) {
 		t.Fatal("No cookies. Header:", hdr)
 	}
 
-	if !strings.Contains(cookies[0], "SameSite=Lax") {
-		t.Fatal("Set-Cookie does not contains SameSite=Lax, cookie string:", cookies[0])
+	if !strings.Contains(cookies[0], "SameSite=None") || !strings.Contains(cookies[0], "Secure") {
+		t.Fatal("Set-Cookie does not contains SameSite=None with Secure, cookie string:", cookies[0])
 	}
 
 	if _, err = store.Get(req, "session:key"); err.Error() != "sessions: invalid character in cookie name: session:key" {
diff --git a/store.go b/store.go
index bc75936..24db822 100644
--- a/store.go
+++ b/store.go
@@ -56,7 +56,8 @@ func NewCookieStore(keyPairs ...[]byte) *CookieStore {
 		Options: &Options{
 			Path:     "/",
 			MaxAge:   86400 * 30,
-			SameSite: http.SameSiteLaxMode,
+			SameSite: http.SameSiteNoneMode,
+			Secure:   true,
 		},
 	}