AB#117049 Switch to Spring Boot method of setting SameSite

[buckett]

This drops our code so we just set the standard property.

[Copilot]

Pull request overview

This PR switches SameSite cookie configuration from a custom embedded-Tomcat cookie processor to Spring Boot’s standard configuration property, aiming to support cross-origin OAuth flows.

Changes:

• Configure session cookie SameSite via server.servlet.session.cookie.same-site=None.
• Remove the custom TomcatConfiguration that previously set SameSite=None through Tomcat’s Rfc6265CookieProcessor.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/main/resources/application.properties	Adds Spring Boot property to set session cookie SameSite to None.
src/main/java/uk/ac/ox/ctl/ltiauth/TomcatConfiguration.java	Deletes Tomcat-specific SameSite cookie processor customization in favor of property-based config.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

SameSite=None cookies are ignored/rejected by modern browsers unless they also have the Secure attribute. This property is set in the base application.properties, but server.servlet.session.cookie.secure=true is only configured in application-aws.properties, so the comment about cross-origin OAuth may not hold for non-aws profiles (e.g. docker/local) and could break the flow in those environments. Consider scoping same-site=None to the same profiles where cookie.secure (and HTTPS / forwarded-proto handling) are guaranteed, or explicitly document/enforce the Secure requirement for all deployments that rely on cross-site cookies.

Suggested change

	# This is needed for the OAuth flow so that the cookie is sent in cross-origin requests.
	server.servlet.session.cookie.same-site=None
	# Default to a browser-compatible setting for non-HTTPS/local profiles.
	# Profiles that require cross-origin OAuth must override this to `None` and also set
	# `server.servlet.session.cookie.secure=true` so modern browsers will accept the cookie.
	server.servlet.session.cookie.same-site=Lax

[sebastianchristopher]

LGTM