[andresbott]

Summary

cookieauth set SameSite=None on both the registry session-id cookie and
NewCookieStore. Combined with no CSRF protection and bodyless POST
revoke/logout endpoints, that let any site act on a visitor's session — logging
them out everywhere, at minimum. The rest of the library
(attemptstore/cookie, pendingstore/cookie) was already on Lax;
cookieauth was the outlier.

What

• New auth/cookieauth/cookieattrs.go is the single source of truth for
  Path/HttpOnly/Secure/SameSite, applied by NewCookieStore,
  NewFsStore and the registry flavour's hand-built cookie alike. Default is
  now SameSite=Lax.
• NewFsStore no longer inherits gorilla's bare defaults, which carried no
  HttpOnly, Secure or SameSite at all — weaker than either site the TODO
  named.
• New Cfg.SameSite (registry flavour, zero value → Lax) restores parity of
  configurability: the stateless flavour could already reach these attributes
  via Store.Options, the registry flavour had no knob. Setting it alongside
  Cfg.Store is a construction error, matching how HashKey/BlockKey are
  rejected there; an out-of-range value is rejected too.
• clearSID now derives the deletion cookie from sidCookie with a past
  expiry instead of duplicating the literal. A browser only replaces a cookie
  when name/path/domain agree, so one builder is what keeps logout correct — and
  it leaves a single //nolint:gosec (down from two) on the one line that
  decides the policy.
• Tests pin what nothing asserted before: both store constructors' options,
  both flavours' emitted cookies and their equality, login/logout attribute
  match, the override table, and both rejection paths.

Notes

Behaviour change, no API removed and no data migration —
docs/agents/migration-cookie-samesite.md covers the two ways a consumer can
break: a cross-site deployment (must opt back into None and add its own CSRF
protection) and NewFsStore over plain HTTP (its cookies are now Secure).
Nothing in-tree uses NewFsStore.