Add ability to set cookie SameSite attribute (#38)

Author: lfuelling

session.go

@@ -89,6 +89,8 @@ type Options struct {
 	Secure bool
 	// Cookie life time. Default is 0.
 	CookieLifeTime int
+	// Cookie SameSite default is false (Lax), can be set to true (Strict)
+	CookieSameSite bool
 	// Cookie domain name. Default is empty.
 	Domain string
 	// Session ID length. Default is 16.
@@ -130,6 +132,9 @@ func prepareOptions(options []Options) Options {
 	if !opt.Secure {
 		opt.Secure = sec.Key("SECURE").MustBool()
 	}
+	if !opt.CookieSameSite {
+		opt.CookieSameSite = sec.Key("COOKIE_SAME_SITE").MustBool()
+	}
 	if opt.CookieLifeTime == 0 {
 		opt.CookieLifeTime = sec.Key("COOKIE_LIFE_TIME").MustInt()
 	}
@@ -292,13 +297,19 @@ func (m *Manager) Start(ctx *macaron.Context) (RawStore, error) {
 		return nil, err
 	}
 
+	sameSite := http.SameSiteLaxMode
+	if m.opt.CookieSameSite {
+		sameSite = http.SameSiteStrictMode
+	}
+
 	cookie := &http.Cookie{
 		Name:     m.opt.CookieName,
 		Value:    sid,
 		Path:     m.opt.CookiePath,
 		HttpOnly: true,
 		Secure:   m.opt.Secure,
 		Domain:   m.opt.Domain,
+		SameSite: sameSite,
 	}
 	if m.opt.CookieLifeTime >= 0 {
 		cookie.MaxAge = m.opt.CookieLifeTime