fix(auth): Set the cookie's SameSite policy to "lax"

Safari's SameSite policy applies throughout the entire session. This means that when we redirect to Google, then back to the callback, and finally to the homepage, the last redirect does not meet the strict SameSite requirements. As a result, the user must log in again.

According to https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#section-6.1.3.3.1, SameSite can be set to Lax.

Author: pan93412

lib/auth.ts

@@ -50,7 +50,7 @@ export async function setAuthToken(
   cookieStore.set(OAUTH_CONFIG.TOKEN_COOKIE_NAME, token, {
     httpOnly: true,
     secure: true,
-    sameSite: "strict",
+    sameSite: "lax",
     maxAge: expiresIn,
     path: "/",
   });
@@ -68,7 +68,7 @@ export async function clearAuthToken(): Promise<void> {
     name: OAUTH_CONFIG.TOKEN_COOKIE_NAME,
     httpOnly: true,
     secure: true,
-    sameSite: "strict",
+    sameSite: "lax",
     path: "/",
   });
 }