Allow setting SameSite mode of the SessionId cookie

[jhartmann123]

What issue does this PR address?
The SameSite mode of the sessionId cookie can be configured with this PR. It was hardcoded to SameSiteMode.None before.

We set this to SameSiteMode.Lax for serving via http for local development (in a docker instance), where SameSite=None cookies get ignored (Chrome 84). SameSite=None only works for Secure cookies.

Does this PR introduce a breaking change?
No. The default is still SameSiteMode.None

Please check if the PR fulfills these requirements

• The commit follows our guidelines
• Unit Tests for the changes have been added (for bug fixes / features)

Other information:

[dnfadmin]

All CLA requirements met.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Questions are community supported only and the authors/maintainers may or may not have time to reply. If you or your company would like commercial support, please see here for more information.

[brockallen]

Great, thanks!

[nasir-awan]

How do we change the SameSiteMode ?

This code does not change it

builder.Services.ConfigureExternalCookie(options =>
           {
               options.Cookie.IsEssential = true;
               options.Cookie.SameSite = SameSiteMode.Lax;
               options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
           });


           builder.Services.ConfigureApplicationCookie(options =>
           {
               options.Cookie.IsEssential = true;
               options.Cookie.SameSite = SameSiteMode.Lax;
               options.Cookie.SecurePolicy = CookieSecurePolicy.Always;

           });

[marlon-tucker]

It's configured via this:

var identityServerBuilder = services.AddIdentityServer(options =>
                {
                    options.Authentication.CheckSessionCookieSameSiteMode = SameSiteMode.Lax; // Or whatever you wish
                })

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.