fix:(middlewares.go) - Set Cookie SameSite mode to Strict - 1776 (#1777)

* None is deprecated and will fallback to Lax in the future.
* Using Strict is future proof and provides additional CSR protection

Signed-off-by: Manuel Kroeber <manuel.kroeber@gmail.com>

Signed-off-by: Manuel Kroeber <manuel.kroeber@gmail.com>

server/middlewares.go

@@ -112,7 +112,7 @@ func clientUniqueIdAdder(next http.Handler) http.Handler {
 				MaxAge:   consts.CookieExpiry,
 				HttpOnly: true,
 				Secure:   true,
-				SameSite: http.SameSiteNoneMode,
+				SameSite: http.SameSiteStrictMode,
 				Path:     "/",
 			}
 			http.SetCookie(w, c)

server/subsonic/middlewares.go

@@ -161,6 +161,7 @@ func getPlayer(players core.Players) func(next http.Handler) http.Handler {
 					Value:    player.ID,
 					MaxAge:   consts.CookieExpiry,
 					HttpOnly: true,
+					SameSite: http.SameSiteStrictMode,
 					Path:     "/",
 				}
 				http.SetCookie(w, cookie)