From a8cb5c5933e95aac90d70222f017b09e5830031d Mon Sep 17 00:00:00 2001
From: hobokenchicken <dustin@dustin.coffee>
Date: Thu, 16 Jul 2026 14:52:13 -0400
Subject: [PATCH] fix: use SameSite=Lax for session cookie

SameSite=None requires Secure=true or modern browsers silently reject
the Set-Cookie header. Since the site is served over HTTPS via Caddy,
this was causing login to succeed (200) but the session cookie to be
dropped, making the subsequent /auth/me call fail with 401.

SameSite=Lax is the correct setting for same-origin session cookies.
---
 internal/auth/cookie.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/internal/auth/cookie.go b/internal/auth/cookie.go
index 0af5b15..fc042b1 100644
--- a/internal/auth/cookie.go
+++ b/internal/auth/cookie.go
@@ -17,7 +17,8 @@ func SetSessionCookie(w http.ResponseWriter, cookieName, token string, duration
 		Path:     "/",
 		HttpOnly: true,
 		Secure:   secure,
-		SameSite: http.SameSiteNoneMode,
+		SameSite: http.SameSiteLaxMode,
 		MaxAge:   int(duration.Seconds()),
 	})
 }
+