OIDCCookieSameSite clarification

[OlivierBOEL]

Hello,

I'm puzzled about this comment.
From my experice with mod_auth_openidc v2.3.7, it looks like SameSite attribute is set to strict after 10% of OIDCSessionInactivityTimeout (with a max. of 60 seconds).
Could this code explain what I've obeserved?
Or did I miss something?

Thanks,

Olivier

[zandbelt]

the idea is to set the cookie to Lax immediately after returning from the OP since that's the only value that works after a redirect; after that, i.e. upon the first update of the session, the cookie is set to Strict; the first update happens indeed faster than the inactivity timeout, but it is kind of cumbersome to explain all of that there since it is not that relevant...