From 013ea9006352ed714cbbd561880770062ea3a0e9 Mon Sep 17 00:00:00 2001
From: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
Date: Sat, 6 Mar 2021 23:19:08 +0300
Subject: Sets Token Cookie To Same Site To Lax

Sets the authorization token cookie's security policy to lax, to allow
it to work on the site.

Signed-off-by: Hassan Abouelela <47495861+HassanAbouelela@users.noreply.github.com>
---
 backend/routes/auth/authorize.py | 2 +-
 backend/routes/forms/submit.py   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'backend/routes')

diff --git a/backend/routes/auth/authorize.py b/backend/routes/auth/authorize.py
index 26d8622..e00aef2 100644
--- a/backend/routes/auth/authorize.py
+++ b/backend/routes/auth/authorize.py
@@ -63,7 +63,7 @@ async def process_token(bearer_token: dict) -> Union[AuthorizeResponse, AUTH_FAI
 
     response.set_cookie(
         "token", f"JWT {token}",
-        secure=constants.PRODUCTION, httponly=True, samesite="strict",
+        secure=constants.PRODUCTION, httponly=True, samesite="lax",
         max_age=bearer_token["expires_in"]
     )
     return response
diff --git a/backend/routes/forms/submit.py b/backend/routes/forms/submit.py
index 8680b2d..8803b7c 100644
--- a/backend/routes/forms/submit.py
+++ b/backend/routes/forms/submit.py
@@ -76,7 +76,7 @@ class SubmitForm(Route):
 
                     response.set_cookie(
                         "token", f"JWT {request.user.token}",
-                        secure=constants.PRODUCTION, httponly=True, samesite="strict",
+                        secure=constants.PRODUCTION, httponly=True, samesite="lax",
                         max_age=(expiry - datetime.datetime.now()).seconds
                     )
 
-- 
cgit v1.2.3