Revert "authenticate,proxy: add same site lax to cookies"

[desimone]

Reverts #2159

Summary

In certain situations, when Pomerium is paired with additional single-sign-on (SSO) systems (e.g. SAML) which perform a POST following authentication, the _pomerium session could would not be set, and would result in an erroneous / blocking redirect flow loop.

Next steps

We should allow user's to set their desired SameSite value as an option, and default to None.

Q: What is the Lax + POST mitigation?
This is a specific exception made to account for existing cookie usage on some Single Sign-On implementations where a CSRF token is expected on a cross-site POST request. This is purely a temporary solution and will be removed in the future. It does not add any new behavior, but instead is just not applying the new SameSite=Lax default in certain scenarios.
Specifically, a cookie that is at most 2 minutes old will be sent on a top-level cross-site POST request. However, if you rely on this behavior, you should update these cookies with the SameSite=None; Secure attributes to ensure they continue to function in the future.

[codeclimate]

Code Climate has analyzed commit da92cb4 and detected 0 issues on this pull request.

View more on Code Climate.