Add the service-to-service module

cors-csrf/docs/07-samesite.md

@@ -20,11 +20,7 @@ The session cookie gets `SameSite=Lax` from Boot's
 at all**: `CookieCsrfTokenRepository`'s default cookie customizer is, in bytecode, a single
 `return`. Nothing is set.
 
-An absent `SameSite` is not "no restriction". Chromium-based browsers treat it as `Lax`; Firefox has
-**not** enabled Lax-by-default on its release channel (`network.cookie.sameSite.laxByDefault` is on in
-Nightly only). The two disagree, which is why "it works in Firefox and not in Chrome" is so often a
-missing `SameSite` attribute. `SpecCookieJar` models the Chromium behaviour, because that is the one
-you have to survive.
+An absent `SameSite` is not "no restriction". Every current browser treats it as `Lax`.
 
 ## The two rules that matter
 

cors-csrf/src/main/java/com/ankurm/cors/spec/SpecCookieJar.java

@@ -24,10 +24,7 @@ import java.util.Map;
  * <li><b>&sect;5.8.3 sending.</b> A cookie whose {@code same-site-flag} is {@code Strict} or
  * {@code Lax} is not attached to a cross-site request; {@code Lax} makes an exception for
  * top-level safe-method navigations, which a {@code fetch()} from a SPA is not. A cookie with
- * no {@code SameSite} attribute is treated as {@code Lax} &mdash; by Chromium-based browsers.
- * Firefox has not enabled Lax-by-default on its release channel, so it still treats an absent
- * attribute as unrestricted. This jar models the Chromium behaviour, because that is the one
- * a deployment has to survive.</li>
+ * no {@code SameSite} attribute is treated as {@code Lax}.</li>
  * </ul>
  *
  * <p>Feeding the real {@code Set-Cookie} headers the application emits through this jar is what
@@ -122,9 +119,7 @@ public final class SpecCookieJar {
 	}
 
 	private static boolean willSend(StoredCookie cookie, Context context, boolean safeMethod) {
-		// No SameSite attribute means Lax in Chromium-based browsers, which is where the modern
-		// default bites. Firefox's release channel still treats an absent attribute as
-		// unrestricted; modelling the stricter of the two is the useful choice.
+		// No SameSite attribute means Lax, which is where the modern default bites.
 		String effective = (cookie.sameSite() == null) ? "Lax" : cookie.sameSite();
 		return switch (context) {
 			case SAME_SITE -> true;