Respect SameSite in Auth Cookie

[madaster97]

Description

This PR addresses issue #187 by dynamically using the config.session.cookie.sameSite cookie attribute on the auth_verification cookie ONLY when the response mode is not form_post.

Prior to this, any response mode other than form_post would set the auth_verification cookie (which contains state, nonce and PKCE values) with the None SameSite attribute, and would otherwise default to Lax.

The main use case is for non- form_post response type flows, where the RP would like the auth cookie to have a SameSite value of None or Strict, rather than the forced default of Lax.

Docs on the Setting

The language (see docs) around the SameSite field states:

Defaults to "Lax" but will be adjusted based on {@link AuthorizationParameters.response_type}.

It seems the docs above actually meant to mention response_mode, if that's the case, we should address that here as well.

From that language, I belive the intended behavior was that:

1. The appSession cookie will always use the configured sameSite value
2. The auth_verification cookie will:
   • use SameSite=None for form_post response types, ignoring config
   • Otherwise respect the configured sameSite attribute

Potential Security Concern

Up to this point, devs may be relying on the default of Lax for response modes other than form_post. TBD: What are the security considerations for changing that default behavior, given that:

1. The default for config.session.cookie.sameSite is also Lax
2. We would only ever use another SameSite value if it was intentionally set in the config, and already be in use for the appSession cookie.

References

• Fixes Issue SameSite config not respected by auth cookie #187
• Lib Docs on SameSite Cookie
• MDN Article on SameSite Cookies Attribute

Testing

I added tests to cover what I believe is the expected behavior (see above).

• This change adds test coverage in the login.tests.js file (see last two tests)
• • Test that form_post response modes ignore config and use None
• • Test that other response modes respect configured SameSite attribute

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
  • ???: See above for potential doc change. I'd like someone to review the SameSite config docs to make sure I'm interpreting it correctly (response_type is mentioned, but should it be response_mode?).
• All active GitHub checks for tests, formatting, and security are passing
  • ???: All tests are passing and linting looks good, but what about security testing?
• The correct base branch is being used, if not master

[madaster97]

Add a utility function to test, and Refactor other function to use it.

Referenced below in my new test cases.