Use cookie SameSiteLaxMode when secure is false

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

docs/CONFIGURATION.md

@@ -369,6 +369,8 @@ Session cookie lifetime in hours.
 
 Controls whether the Secure flag is set on session cookies. When true, cookies are only sent over HTTPS connections.
 
+**Important**: This must be set to `true` for SAML authentication to work properly. SAML requires `SameSite=None` cookies for cross-site POST requests from identity providers, and modern browsers require the `Secure` flag to be set when using `SameSite=None`. Setting this to `false` will cause SAML authentication to fail as session cookies will be rejected by browsers.
+
 #### `auth.password.pepper` (string)
 
 **Default**: Auto-generated

pkg/securecookie/securecookie.go

@@ -60,6 +60,11 @@ type Config struct {
 
 // DefaultConfig returns a default secure cookie configuration
 func DefaultConfig(name, secret string, secure bool) Config {
+	sameSite := http.SameSiteNoneMode // None mode required for SAML (cross-site POST from IdP)
+	if !secure {
+		sameSite = http.SameSiteLaxMode
+	}
+
 	return Config{
 		Name:     name,
 		Secret:   secret,
@@ -67,7 +72,7 @@ func DefaultConfig(name, secret string, secure bool) Config {
 		MaxAge:   86400 * 30, // 30 days
 		Secure:   secure,
 		HTTPOnly: true,
-		SameSite: http.SameSiteNoneMode, // None mode required for SAML (cross-site POST from IdP)
+		SameSite: sameSite,
 	}
 }