Add SameSite attribute and security flags to authentication cookies

[Copilot]

Cookies set by CasWAF lacked the SameSite attribute, causing browsers to apply inconsistent defaults and potentially exposing the application to CSRF attacks.

Changes

• service/captcha.go: Updated casdoor_captcha_token cookie

  • Set SameSite: http.SameSiteLaxMode
  • Enabled HttpOnly: true
  • Set Secure: scheme == "https" (conditional on connection type)

• service/oauth.go: Updated casdoor_access_token cookie

  • Set SameSite: http.SameSiteLaxMode
  • Enabled HttpOnly: true
  • Set Secure: scheme == "https" (conditional on connection type)

• service/cookie_test.go: Added tests validating cookie security attributes for both HTTP and HTTPS contexts

Example

// Before
cookie := &http.Cookie{
    Name:  "casdoor_access_token",
    Value: token.AccessToken,
    Path:  "/",
}

// After
scheme := getScheme(r)
cookie := &http.Cookie{
    Name:     "casdoor_access_token",
    Value:    token.AccessToken,
    Path:     "/",
    HttpOnly: true,
    Secure:   scheme == "https",
    SameSite: http.SameSiteLaxMode,
}

The SameSite=Lax setting prevents CSRF attacks while preserving cookie functionality for OAuth callbacks and top-level navigation.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Cookie with Missing, Inconsistent, or Conflicting Attributes</issue_title>
<issue_description>List of cookies with missing, inconsistent, or conflicting attributes:
https://ai-admin.casibase.com/

Cookie set with the following attributes:
Set-Cookie: casibase_session_id=6a409bcc77e742bf3def00e4cff5e59a; Path=/; HttpOnly

This cookie has the following issues:

• Cookie without SameSite attribute.

When cookies lack the SameSite attribute, web browsers may apply different and sometimes unexpected defaults. It is therefore recommended to add a SameSite attribute with an appropriate value of either "Strict", "Lax", or "None".

At least one attribute of the cookie causes this cookie to be invalid or incompatible with other attributes of this cookie or the usage environment of this cookie. While this is not a vulnerability in itself, it may lead to unexpected behavior in the application, which could result in minor security issues.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Cookie with Missing, Inconsistent, or Conflicting Attributes #115

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}