From f4f6e8560bfe6e41e3c453cb0cac667929d33651 Mon Sep 17 00:00:00 2001 From: hobokenchicken Date: Thu, 16 Jul 2026 14:26:18 -0400 Subject: [PATCH] fix(auth): set SameSite=None for session cookies to fix cross-origin session loss in Tauri apps --- internal/auth/cookie.go | 2 +- internal/auth/webauthn.go | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/internal/auth/cookie.go b/internal/auth/cookie.go index def5e70..0af5b15 100644 --- a/internal/auth/cookie.go +++ b/internal/auth/cookie.go @@ -17,7 +17,7 @@ func SetSessionCookie(w http.ResponseWriter, cookieName, token string, duration Path: "/", HttpOnly: true, Secure: secure, - SameSite: http.SameSiteLaxMode, + SameSite: http.SameSiteNoneMode, MaxAge: int(duration.Seconds()), }) } diff --git a/internal/auth/webauthn.go b/internal/auth/webauthn.go index 68ec723..0d832a0 100644 --- a/internal/auth/webauthn.go +++ b/internal/auth/webauthn.go @@ -234,7 +234,8 @@ func (h *WebAuthnHandler) LoginBegin(w http.ResponseWriter, r *http.Request) { Path: "/", HttpOnly: true, MaxAge: 300, // 5 minutes - SameSite: http.SameSiteStrictMode, + SameSite: http.SameSiteNoneMode, + Secure: true, }) w.Header().Set("Content-Type", "application/json") @@ -341,7 +342,8 @@ func (h *WebAuthnHandler) LoginFinish(w http.ResponseWriter, r *http.Request) { Path: "/", HttpOnly: true, MaxAge: -1, - SameSite: http.SameSiteStrictMode, + SameSite: http.SameSiteNoneMode, + Secure: true, }) w.Header().Set("Content-Type", "application/json")