CBG-4962 create cookie with SameSite=None if CORS enabled

[torcolvin]

CBG-4962 create cookie with SameSite=None if CORS enabled

Preserve existing behavior unless CORS is enabled. If CORS is enabled, pass SameSite=None to allow cross origin requests.

Pre-review checklist

• Removed debug logging (fmt.Print, log.Print, ...)
• Logging sensitive data? Make sure it's tagged (e.g. base.UD(docID), base.MD(dbName))
• Updated relevant information in the API specifications (such as endpoint descriptions, schemas, ...) in docs/api

[Copilot]

Pull Request Overview

This PR modifies cookie creation to set SameSite=None when CORS is enabled, allowing cross-origin authenticated requests while preserving existing behavior when CORS is disabled.

• Updated MakeSessionCookie to accept a sameSite parameter
• Modified session creation to set SameSite=None when CORS is configured
• Added test coverage to verify cookie attributes for both CORS-enabled and CORS-disabled scenarios

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
rest/session_api.go	Added logic to set SameSite=None when CORS is enabled during session cookie creation
auth/session.go	Updated MakeSessionCookie function signature to accept sameSite parameter
rest/session_test.go	Added tests verifying SameSite attribute behavior with and without CORS configuration
rest/cors_test.go	Added assertion to verify SameSite=None in existing CORS test
auth/session_test.go	Updated all test calls to pass http.SameSiteDefaultMode parameter

[Copilot]

When setting SameSite=None, the Secure flag must also be set to true for the cookie to be accepted by browsers. The current implementation doesn't enforce this constraint. Consider adding validation to ensure SecureCookieOverride is true when CORS is enabled, or document this requirement.

Suggested change

	if !h.getCORSConfig().IsEmpty() {
	sameSite = http.SameSiteNoneMode
	}
	cookie := auth.MakeSessionCookie(session, h.db.Options.SecureCookieOverride, h.db.Options.SessionCookieHttpOnly, sameSite)
	secure := h.db.Options.SecureCookieOverride
	if !h.getCORSConfig().IsEmpty() {
	sameSite = http.SameSiteNoneMode
	// When SameSite=None, Secure must be true for browser compatibility.
	secure = true
	}
	cookie := auth.MakeSessionCookie(session, secure, h.db.Options.SessionCookieHttpOnly, sameSite)

[github-actions]

Redocly previews

• Admin API
• Public API
• Metric API
• Diagnostic API

[adamcfraser]

Looks good to me. One documentation suggestion, otherwise looks fine.

[adamcfraser]

I had to go verify that http.Cookie doesn't emit the SameSite attribute when SameSiteDefaultMode is specified, to ensure we won't see any functional change for users not using CORS or setting the flag.
It's possible that's worth mentioning the default handling in a function description comment, to make that clear. (on the fence about the necessity of that, take it or leave it)