Set SameSite attribute in cookies

[bernd]

Fixes #16428

TODO

• [x] Check if we can use NewCookie.SameSite.STRICT or have to use NewCookie.SameSite.LAX
  • We can use the STRICT value. See: https://github.com/Graylog2/graylog2-server/pull/18329#issuecomment-1961115470

[bernd]

@dennisoelkers I think we have to use the Lax value for the SameSite cookie attribute. Otherwise, users who follow links to a Graylog dashboard won't be logged in.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value

What do you think?

[bernd]

@dennisoelkers Do you have any feedback on this?

[dennisoelkers]

@bernd, from my perspective using SameSite=Strict should be okay. The authentication cookie will be blocked in the first request (to avoid linking directly to destructive/insecure API endpoints), which in our case is unauthenticated anyway, because it just loads the HTML boilerplate.

[bernd]

@dennisoelkers Thank you for the update. Sounds good. I tested the STRICT setting with a link from an external page. The cookie doesn't get transferred when I click the link. :+1:

Can you review the change? Thanks!