SameSite default value update

[NinoFloris]

According to hapijs/bell#355 (which I found as it links to aspnet/Security#1231) chrome > v65 has fixed their samesite behavior to be in line with other browsers. This should allow SameSite.Strict in a few cases again.

I haven't tested this but I do think it's important to see if the default security can be increased again.

[muratg]

Let's reevaluate in 2.2.

[Eilon]

We should take a look to see if we can remove the cookie policy setting in the templates and get that done ASAP.

We should separately look to see if all the major browsers support SameSite in an acceptable manner and consider changing the template (or library) to even use Strict.

[kanadaj]

I am told Strict still causes problems with iPhone.

[Eilon]

Putting in Backlog while we wait for the state of common browsers to settle. In the meantime apps can set the policy themselves.

[Tratcher]

iOS has implemented a much different policy than other browsers and that discourages us from making further investments here until they get it sorted out.
Related:

• Microsoft Security Advisory: iOS12 breaks social, WSFed and OIDC logins aspnet/Announcements#318
• [Announcement] Some Cookie SameSite defaults changed to None #8212

[Tratcher]

I did some testing recently with the modified samesite=lax default policy being added to browsers (#12125). Most of our components worked OK, but I did not go back and test Safari/iOS.

[blowdart]

Closing as updates for 3.1 and 3.0 and 2.2 were released for new samesite changes google made