SameSite should be set to 'None' on the saml_session cookie

[m6312]

djangosaml2 is not setting the SameSite attribute on the saml_session cookie, which leaves it up to browsers to decide whether the cookie is sent with cross-site requests. Browsers are starting to default to SameSite=Lax when a cookie is missing a SameSite attribute, see:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#browser_compatibility
https://www.chromestatus.com/feature/5088147346030592

This behaviour breaks SP-initiated login with the HTTP-POST protocol when using djangosaml2, since browsers will refuse to send the saml_session cookie in the request to /saml2/acs/ (because that request is a third-party request initiated by the IdP). This causes djangosaml2 to raise an UnsolicitedResponse error.

I think that djangosaml2 should explicitly set SameSite=None on the saml_session cookie. This would allow the cookie to be sent in third-party requests.

This issue is very similar to #243, but I think there might have been some confusion there between calling response.set_cookie with samesite=None (which results in a cookie without a SameSite attribute), and setting SameSite=None on the cookie.

[peppelinux]

I saw this
https://github.com/peppelinux/djangosaml2/blob/78907409eaf58a72e300feb51666246a7b879e4e/djangosaml2/middleware.py#L37

and probably the confusion of None as value is for real :)

I'd take some time to do tests, can you go further with this and give feedbacks here and, eventually a PR?

[peppelinux]

We just have to do a test, debugging requests (we need to check the samesite value in the saml_session cookie) and if not valid subsitute that None with "None" if I'm not wrong

[peppelinux]

It seems we had a regression here
a382e9e#diff-8456fbf6b58da9cc1f40d6f9ad78501456372ceeac94ea19946942fc8f64a7fd

but that's not true, it simply reuse the general settings (to None, eventually ...)

[peppelinux]

We have a problem with multiple django release
https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-cookie-samesite

So None is the good value, 'None' would fail on some django version (py38 with django 2.2)
which django version are you using?

with this current setting, correct me if I'm wrong, in Django the possible values for the Cookie setting are 'Lax' (default), 'Strict' or None. The latter disables the flag completely, resulting in a pre-SameSite behavior for the cookie.