Cookie “mahara” will be soon rejected because it has the “SameSite” attribute set to “None”

[Robert Lyon]

Currently in Firefox on the console log it is warning about:
 Cookie “mahara” will be soon rejected because it has the “SameSite” attribute set to “None”

This exists when viewing the site in http:// mode

It doesn't seem to be an issue in https:// mode as the cookie can have the secure option there

This can be fixed up by adding the SameSite cookie attribute to the session cookie / ctest cookie

[Kristina Hoeppner (kris-hoeppner)]

Set to 'Low' importance because sites should be running with an SSL certificate these days.

[Doris Tam (doristam)]

To test this bug:

Locally test this for 'http' mode.
1. Before applying the fix, open the developer console in the browser to see the 'SameSite' warning. This will appear on any page in Mahara.
2. After applying the patch, the console warning goes away.

Warning:
Cookie “mahara” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

[Mahara Bot (dev-mahara)]

Patch for "main" branch: https://reviews.mahara.org/12134

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/c/mahara/+/12134
Committed: https://git.mahara.org/mahara/mahara/commit/33f2b29b1c0331847489d7eacc720da7e21b58d8
Submitter: "Gold <email address hidden>"
Branch: main

commit 33f2b29b1c0331847489d7eacc720da7e21b58d8
Author: Robert Lyon <email address hidden>
Date: Sat Sep 11 15:49:00 2021 +1200

Bug 1943525: Setting the non https site cookies 'samesite' option

When we are using non-https site we need to define the samesite option
to be something other than 'none'
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

So will set this to be 'lax' the new default value

Change-Id: If4011fff680e18ed4ca7600164fb9b64f815b9df
Signed-off-by: Robert Lyon <email address hidden>

[Mahara Bot (dev-mahara)]

Patch for "21.10_DEV" branch: https://reviews.mahara.org/c/mahara/+/12567

[Mahara Bot (dev-mahara)]

Patch for "21.04_DEV" branch: https://reviews.mahara.org/c/mahara/+/12597

[Mahara Bot (dev-mahara)]

Patch for "20.10_DEV" branch: https://reviews.mahara.org/c/mahara/+/12568

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/c/mahara/+/12567
Committed: https://git.mahara.org/mahara/mahara/commit/27550c7b78c8b11f642fc1becff8b287bd132b56
Submitter: "Robert Lyon <email address hidden>"
Branch: 21.10_DEV

commit 27550c7b78c8b11f642fc1becff8b287bd132b56
Author: Robert Lyon <email address hidden>
Date: Sat Sep 11 15:49:00 2021 +1200

Bug 1943525: Setting the non https site cookies 'samesite' option

When we are using non-https site we need to define the samesite option
to be something other than 'none'
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

So will set this to be 'lax' the new default value

Change-Id: If4011fff680e18ed4ca7600164fb9b64f815b9df
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit 33f2b29b1c0331847489d7eacc720da7e21b58d8)

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/c/mahara/+/12597
Committed: https://git.mahara.org/mahara/mahara/commit/a76fb1342fe6fd79d5974537883b79eb7b03c24d
Submitter: "Robert Lyon <email address hidden>"
Branch: 21.04_DEV

commit a76fb1342fe6fd79d5974537883b79eb7b03c24d
Author: Robert Lyon <email address hidden>
Date: Sat Sep 11 15:49:00 2021 +1200

Bug 1943525: Setting the non https site cookies 'samesite' option

When we are using non-https site we need to define the samesite option
to be something other than 'none'
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

So will set this to be 'lax' the new default value

Change-Id: If4011fff680e18ed4ca7600164fb9b64f815b9df
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit 33f2b29b1c0331847489d7eacc720da7e21b58d8)

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/c/mahara/+/12568
Committed: https://git.mahara.org/mahara/mahara/commit/f1d00aa502d2f8003407fc7f3d7e9da97519a772
Submitter: "Robert Lyon <email address hidden>"
Branch: 20.10_DEV

commit f1d00aa502d2f8003407fc7f3d7e9da97519a772
Author: Robert Lyon <email address hidden>
Date: Sat Sep 11 15:49:00 2021 +1200

Bug 1943525: Setting the non https site cookies 'samesite' option

When we are using non-https site we need to define the samesite option
to be something other than 'none'
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

So will set this to be 'lax' the new default value

Change-Id: If4011fff680e18ed4ca7600164fb9b64f815b9df
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit 33f2b29b1c0331847489d7eacc720da7e21b58d8)