Remove :same-site :strict default

Browsers default to :lax, which is a more sensible default. Fixes #32.

Author: weavejester

src/ring/middleware/defaults.clj

@@ -42,7 +42,7 @@
                :keywordize true}
    :cookies   true
    :session   {:flash true
-               :cookie-attrs {:http-only true, :same-site :strict}}
+               :cookie-attrs {:http-only true}}
    :security  {:anti-forgery   true
                :frame-options  :sameorigin
                :content-type-options :nosniff}

test/ring/middleware/defaults_test.clj

@@ -29,8 +29,7 @@
       (is (= (get-in resp [:headers "Content-Type"]) "application/octet-stream"))
       (let [set-cookie (first (get-in resp [:headers "Set-Cookie"]))]
         (is (.startsWith set-cookie "ring-session="))
-        (is (.contains set-cookie "HttpOnly"))
-        (is (.contains set-cookie "SameSite=Strict")))))
+        (is (.contains set-cookie "HttpOnly")))))
 
   (testing "default charset"
     (let [handler (-> (constantly (-> (response "foo") (content-type "text/plain")))