Set 'SameSite=Strict' for all cookies (#2019)

Author: Marcin Maciaszczyk

src/app/core/services/auth/auth.service.ts

@@ -24,11 +24,11 @@ export class Auth {
       if (this.compareNonceWithToken(token, nonce)) {
         // remove URL fragment with token, so that users can't accidentally copy&paste it and send it to others
         this.removeFragment();
-        this._cookieService.set(Auth.Cookie.Token, token, 1, '/', null, true);
+        this._cookieService.set(Auth.Cookie.Token, token, 1, '/', null, true, 'Strict');
         // localhost is only served via http, though secure cookie is not possible
         // following line will only work when domain is localhost
-        this._cookieService.set(Auth.Cookie.Token, token, 1, '/', 'localhost');
-        this._cookieService.set(Auth.Cookie.Token, token, 1, '/', '127.0.0.1');
+        this._cookieService.set(Auth.Cookie.Token, token, 1, '/', 'localhost', false, 'Strict');
+        this._cookieService.set(Auth.Cookie.Token, token, 1, '/', '127.0.0.1', false, 'Strict');
       }
       this._previousRouteService.loadRouting();
     }
@@ -89,7 +89,7 @@ export class Auth {
   }
 
   login(): void {
-    this._cookieService.set(Auth.Cookie.Autoredirect, 'true', 1, '/');
+    this._cookieService.set(Auth.Cookie.Autoredirect, 'true', 1, '/', null, false, 'Strict');
   }
 
   logout(): void {

src/app/pages/frontpage/frontpage.component.ts

@@ -28,11 +28,11 @@ export class FrontpageComponent implements OnInit {
     const nonceRegExp = /[\?&#]nonce=([^&]+)/;
     const nonceStr = nonceRegExp.exec(this._auth.getOIDCProviderURL());
     if (!!nonceStr && nonceStr.length >= 2 && !!nonceStr[1]) {
-      this._cookieService.set(Auth.Cookie.Nonce, nonceStr[1], null, '/', null, true);
+      this._cookieService.set(Auth.Cookie.Nonce, nonceStr[1], null, '/', null, true, 'Strict');
       // localhost is only served via http, though secure cookie is not possible
       // following line will only work when domain is localhost
-      this._cookieService.set(Auth.Cookie.Nonce, nonceStr[1], null, '/', 'localhost');
-      this._cookieService.set(Auth.Cookie.Nonce, nonceStr[1], null, '/', '127.0.0.1');
+      this._cookieService.set(Auth.Cookie.Nonce, nonceStr[1], null, '/', 'localhost', false, 'Strict');
+      this._cookieService.set(Auth.Cookie.Nonce, nonceStr[1], null, '/', '127.0.0.1', false, 'Strict');
     }
   }