[4.0.0.2 backport] CBG-4965 create cookie with SameSite=None if CORS enabled

[torcolvin]

[4.0.0.2 backport] CBG-4965 create cookie with SameSite=None if CORS enabled

clean cherry-pick of 30ee4fe

[github-actions]

Redocly previews

• Admin API
• Public API
• Metric API
• Diagnostic API

[Copilot]

Pull Request Overview

This PR implements support for setting the SameSite cookie attribute on session cookies, with automatic configuration based on CORS settings. By default, when CORS is enabled, session cookies will use SameSite=None to support cross-origin requests. The implementation also adds an unsupported_options.same_site_cookie configuration option to allow manual override of the default behavior.

Key Changes:

• Session cookies now include the SameSite attribute, defaulting to None when CORS is enabled
• Added unsupported_options.same_site_cookie configuration option with validation for "Lax", "Strict", "None", and "Default" values
• Updated MakeSessionCookie function signature to accept a sameSite parameter

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
auth/session.go	Updated MakeSessionCookie to accept and apply SameSite parameter
auth/session_test.go	Updated test calls to MakeSessionCookie with default SameSite mode
db/database.go	Added SameSiteCookieMode field and GetSameSiteCookieMode validation function
rest/session_api.go	Modified session creation to pass SameSite mode to cookie creation
rest/server_context.go	Added logic to set SameSiteNoneMode when CORS is enabled, with override support
rest/config.go	Added validation for same_site_cookie configuration option
rest/config_test.go	Added comprehensive tests for same_site_cookie validation
rest/cors_test.go	Enhanced existing CORS test with SameSite attribute verification
rest/session_test.go	Added test coverage for SameSite behavior with and without CORS
docs/api/components/schemas.yaml	Added OpenAPI specification for same_site_cookie property

[Copilot]

Corrected spelling of 'None' to 'None"' - missing closing quote in error message.

Suggested change

	return http.SameSiteDefaultMode, fmt.Errorf("unsupported_options.same_site_cookie option %q is not valid, choices are \"Lax\", \"Strict\", and \"None", *o.SameSiteCookie)
	return http.SameSiteDefaultMode, fmt.Errorf("unsupported_options.same_site_cookie option %q is not valid, choices are \"Lax\", \"Strict\", and \"None\"", *o.SameSiteCookie)

[Copilot]

Missing space between 'to' and backtick in 'toDefault' - should be 'to Default'.

Suggested change

	Override the session cookie SameSite behavior. By default, a session cookie will have SameSite:None if CORS is enabled, and will have no SameSite attribute if CORS is not enabled. Setting this property to`Default` will omit the SameSite attribute from the cookie.
	Override the session cookie SameSite behavior. By default, a session cookie will have SameSite:None if CORS is enabled, and will have no SameSite attribute if CORS is not enabled. Setting this property to `Default` will omit the SameSite attribute from the cookie.