auth fix

Author: tannerlinsley

src/routes/api/auth/callback/$provider.tsx

@@ -47,7 +47,7 @@ export const Route = createFileRoute('/api/auth/callback/$provider')({
           }
 
           // Clear state cookie (one-time use)
-          const clearStateCookie = `oauth_state=; HttpOnly; Path=/; Max-Age=0; SameSite=Strict${process.env.NODE_ENV === 'production' ? '; Secure' : ''}`
+          const clearStateCookie = `oauth_state=; HttpOnly; Path=/; Max-Age=0; SameSite=Lax${process.env.NODE_ENV === 'production' ? '; Secure' : ''}`
 
         // Exchange code for access token
         // Use SITE_URL env var if set, otherwise fall back to request origin

src/routes/auth/$provider/start.tsx

@@ -22,10 +22,11 @@ export const Route = createFileRoute('/auth/$provider/start')({
           .replace(/=/g, '')
 
         // Store state in HTTPS-only cookie for CSRF protection
-        // SameSite=Strict prevents CSRF attacks
+        // SameSite=Lax allows the cookie to be sent on OAuth redirects (top-level navigations)
+        // while still protecting against CSRF on POST requests
         const stateCookie = `oauth_state=${encodeURIComponent(
           state,
-        )}; HttpOnly; Path=/; Max-Age=${10 * 60}; SameSite=Strict${
+        )}; HttpOnly; Path=/; Max-Age=${10 * 60}; SameSite=Lax${
           process.env.NODE_ENV === 'production' ? '; Secure' : ''
         }`