kolaente f99110c7d2 fix(auth): send the refresh cookie with SameSite=Lax ...

Over https the refresh cookie used SameSite=None. CORS allows localhost
origins by default for the desktop app, so a page on any localhost port
could refresh a session with the user's cookie and read the new token.

The cookie is now always SameSite=Lax. SameSite=None existed for the
desktop app's cookie refresh, which it replaced with OAuth over IPC in
v2.3.0.

Changelog:
- Desktop v2.2.x has to log in again more often; upgrade to v2.3.0 or later.
- Deployments with the frontend and API on different registrable domains
  lose cookie refresh, as before v2.2.0.

2026-10-02 19:08:02 +02:00

..

ldap

fix(auth): use binddn as group sync dn instead of userbind

2026-06-27 15:12:10 +00:00

oauth2server

docs: add swagger annotations for the OAuth 2.0 endpoints (#3837)

2026-09-10 18:05:20 +00:00

openid

refactor(utils): rename NewHTTPClient to NewUnguardedHTTPClient

2026-09-30 18:26:56 +02:00

auth_context_test.go

perf(auth): reuse the api token owner from the request context

2026-09-06 16:40:57 +02:00

auth_test.go

fix(auth): send the refresh cookie with SameSite=Lax

2026-10-02 19:08:02 +02:00

auth.go

fix(auth): send the refresh cookie with SameSite=Lax

2026-10-02 19:08:02 +02:00