SameSite not used correctly on CUPS CGI HTTP Headers

[egberts]

trafficstars

Analyzing Firefox on CUPS localhost:631 CGI port.

On the Console tab of Web Developer Tool (Ctrl-Shift-I):

Cookie “org.cups.sid” will be soon rejected because 
it has the “SameSite” attribute set to “None” or 
an invalid value, without the “secure” attribute. 

To know more about the “SameSite“ attribute, 
read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

For ease of use, the same link is https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

[michaelrsweet]

Looking at the code, the current cookie code does not set SameSite, which isn't defined in RFC 6265 and is only present in an expired ID and described loosely on a variety of vendor websites... Not even WhatWG has touched is AFAICT.

In looking at the expired ID, it looks like we want to add "samesite=secure;" to the Set-Cookie headers, both in cgi-bin/var.c and cups/http.c.

[michaelrsweet]

Revisiting this, it looks like Mozilla has adopted "Lax" as the new default value to not break existing code, so it doesn't look like we need to do anything here.