Merge ~maxiberta/canonical-identity-provider:cookies-explicit-samesite-2 into canonical-identity-provider:master

[Maximiliano Bertacchini]

Set explicit "SameSite=None; Secure" to the openid_referer cookie

Should fix issues with openid authentication on modern browsers, which default to "SameSite=Lax".

See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Session and CSRF cookies are already "SameSite=None; Secure" as per https://code.launchpad.net/~maxiberta/canonical-identity-provider/+git/canonical-identity-provider/+merge/388247.

This patch is already applied on https://login.staging.ubuntu.com. Login at https://staging-api.snapcraft.io/snaps still working (but I didn't manage to reproduce the infinite openid loop originally, tbh).

[Daniel Manrique (roadmr)]

+1 let's merge and test thoroughly on staging.

review: Approve

diff --git a/django_project/settings_base.py b/django_project/settings_base.py
index ba0f454..4c5db9a 100644
--- a/django_project/settings_base.py
+++ b/django_project/settings_base.py
@@ -507,6 +507,7 @@ SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_NAME = 'sessionid'
 SESSION_COOKIE_PATH = '/'
 SESSION_COOKIE_SAMESITE = "None"
+SESSION_COOKIE_SAMESITE_KEYS = {'openid_referer'}
 SESSION_COOKIE_SECURE = True
 SESSION_ENGINE = 'django.contrib.sessions.backends.db'
 SESSION_EXPIRE_AT_BROWSER_CLOSE = False
diff --git a/src/identityprovider/views/server.py b/src/identityprovider/views/server.py
index 7998a85..d41b48a 100644
--- a/src/identityprovider/views/server.py
+++ b/src/identityprovider/views/server.py
@@ -234,7 +234,7 @@ def _handle_user_response(request, orequest):
             reverse('server-decide', kwargs=dict(token=token)))
     referer = request.META.get('HTTP_REFERER')
     if referer:
-        response.set_cookie('openid_referer', referer)
+        response.set_cookie('openid_referer', referer, secure=True)
     return response