Apply SameSite=Lax exception only on safe methods

[nikneym]

On top of #3293.

[karlseguin]

Any thoughts on https://re-sync.nl/en/blog/samesite-lax-cookie-bypass/ ?

(With the official documentation about it: https://www.chromium.org/updates/same-site/faq/#q-what-is-the-lax-post-mitigation)

[nikneym]

Any thoughts on re-sync.nl/en/blog/samesite-lax-cookie-bypass ?

Interesting find & article... Turns out there's also a section that touch this in RFC6265bis:

5.6.7.2. "Lax-Allowing-Unsafe" enforcement

As discussed in Section 8.8.6, compatibility concerns may necessitate
the use of a "Lax-allowing-unsafe" enforcement mode that allows
cookies to be sent with a cross-site HTTP request if and only if it
is a top-level request, regardless of request method. That is, the
"Lax-allowing-unsafe" enforcement mode waives the requirement for the
HTTP request's method to be "safe" in the SameSite enforcement step
of the retrieval algorithm in Section 5.8.3. (All cookies,
regardless of SameSite enforcement mode, may be set for top-level
navigations, regardless of HTTP request method, as specified in
Section 5.7.)

"Lax-allowing-unsafe" is not a distinct value of the SameSite
attribute. Rather, user agents MAY apply "Lax-allowing-unsafe"
enforcement only to cookies that did not explicitly specify a
SameSite attribute (i.e., those whose same-site-flag was set to
"Default" by default). To limit the scope of this compatibility
mode, user agents which apply "Lax-allowing-unsafe" enforcement
SHOULD restrict the enforcement to cookies which were created
recently. Deployment experience has shown a cookie age of 2 minutes
or less to be a reasonable limit.

[nikneym]

This currently conflicts w/ #3448; since both touch SameSite=Lax movement, I'm working on a change that cover both.

[nikneym]

This now also includes a solution for what #3448 trying to fix.

[karlseguin]

LGTM, but I think this is worth tests in ../demo/ (or as an html test in this project if that works). There's 1 unit test for the Cookie.Jar, but the feature requires all the layers to do their part, which isn't tested anywhere.

[nikneym]

Agreed, will add this through demo.