From b5ed7e2364aa92a3a7075a864abeaa1771ebfde2 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Mon, 15 Jun 2026 07:08:24 +0000
Subject: [PATCH] fix(auth): change SameSite to Lax for redirect compatibility

---
 src/core/auth/oidc.go | 2 +-
 src/main.go           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/auth/oidc.go b/src/core/auth/oidc.go
index beae26f..048d9ea 100644
--- a/src/core/auth/oidc.go
+++ b/src/core/auth/oidc.go
@@ -137,7 +137,7 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
 		Domain:   h.config.Domain,
 		MaxAge:   3600,
 		HttpOnly: true,
-		SameSite: http.SameSiteStrictMode,
+		SameSite: http.SameSiteLaxMode,
 	})
 
 	http.Redirect(w, r, "/", http.StatusFound)
diff --git a/src/main.go b/src/main.go
index f2b29e8..9eb9116 100644
--- a/src/main.go
+++ b/src/main.go
@@ -130,7 +130,7 @@ func main() {
 			Domain:   cfg.OIDC.Domain,
 			MaxAge:   -1,
 			HttpOnly: true,
-			SameSite: http.SameSiteStrictMode,
+			SameSite: http.SameSiteLaxMode,
 		})
 		// Redirect to Authelia's logout page to clear Authelia session
 		logoutURL := fmt.Sprintf("%s/logout", cfg.OIDC.IssuerURL)