Medium SeverityCookie DefenseOAuth2Security

The SameSite Cookie Routing Blindspot

1.The Symptom (The Chaos)

A user successfully authenticates via OAuth2, but the browser silently strips the HTTP-only refresh cookie on the top-level redirect, leaving the frontend with a null token and triggering an instant 401 unauthenticated landing.

2.The Trigger Condition

A user lands back on the React SPA following a third-party OAuth2 redirect or a top-level link, and the browser executes the initial background token refresh fetch.

3.The Catch (Why it broke)

We assumed setting SameSite=Strict on HTTP-only cookies provided maximum security everywhere, failing to realize modern browsers treat incoming OAuth redirects as cross-site requests and silently drop Strict cookies on cold page loads.

4.Architectural Trade-offs

To resolve this, we isolate SameSite=Lax strictly to the /api/auth path namespace while maintaining SameSite=Strict on all core routes. This prevents cold-load OAuth session drops while keeping state-mutating endpoints fully protected.

config/CustomOAuth2SuccessHandler.java

[Vulnerable Target View]

// VULNERABLE: Setting SameSite=Strict forces browsers to strip the
// 'refresh_token' cookie during top-level cross-site OAuth redirects.
ResponseCookie refreshCookie = ResponseCookie.from("refresh_token", refreshToken)
        .path("/")
        .httpOnly(true)
        .secure(isSecure)
        .sameSite("Strict") // <--- Root cause: Stripped on OAuth redirect GET!
        .maxAge(604800)
        .build();

response.addHeader("Set-Cookie", refreshCookie.toString());
getRedirectStrategy().sendRedirect(request, response, "http://localhost:5173/oauth2/callback");