Add config option for cookie SameSite policy

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/config/default.js

@@ -27,6 +27,7 @@ module.exports = {
     upgradeInsecureRequests: 'auto',
     reportURI: undefined
   },
+  cookiePolicy: 'strict',
   protocolUseSSL: false,
   useCDN: false,
   allowAnonymous: true,

lib/config/environment.js

@@ -22,6 +22,7 @@ module.exports = {
     enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
     reportURI: process.env.CMD_CSP_REPORTURI
   },
+  cookiePolicy: process.env.CMD_COOKIE_POLICY,
   protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL),
   allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN),
   useCDN: toBooleanConfig(process.env.CMD_USECDN),

lib/config/index.js

@@ -51,6 +51,11 @@ if (['debug', 'verbose', 'info', 'warn', 'error'].includes(config.loglevel)) {
   logger.error('Selected loglevel %s doesn\'t exist, using default level \'debug\'. Available options: debug, verbose, info, warn, error', config.loglevel)
 }
 
+if (!['strict', 'lax', 'none'].includes(config.cookiePolicy)) {
+  logger.error('Cookie SameSite policy %s does not exist. Falling back to strict. Available values are: strict, lax, none.', config.cookiePolicy)
+  config.cookiePolicy = 'strict'
+}
+
 // load LDAP CA
 if (config.ldap.tlsca) {
   let ca = config.ldap.tlsca.split(',')