Add the service-to-service module

cors-csrf/docs/07-samesite.md

@@ -20,7 +20,11 @@ The session cookie gets `SameSite=Lax` from Boot's
 at all**: `CookieCsrfTokenRepository`'s default cookie customizer is, in bytecode, a single
 `return`. Nothing is set.
 
-An absent `SameSite` is not "no restriction". Every current browser treats it as `Lax`.
+An absent `SameSite` is not "no restriction". Chromium-based browsers treat it as `Lax`; Firefox has
+**not** enabled Lax-by-default on its release channel (`network.cookie.sameSite.laxByDefault` is on in
+Nightly only). The two disagree, which is why "it works in Firefox and not in Chrome" is so often a
+missing `SameSite` attribute. `SpecCookieJar` models the Chromium behaviour, because that is the one
+you have to survive.
 
 ## The two rules that matter
 

cors-csrf/src/main/java/com/ankurm/cors/spec/SpecCookieJar.java

@@ -24,7 +24,10 @@ import java.util.Map;
  * <li><b>&sect;5.8.3 sending.</b> A cookie whose {@code same-site-flag} is {@code Strict} or
  * {@code Lax} is not attached to a cross-site request; {@code Lax} makes an exception for
  * top-level safe-method navigations, which a {@code fetch()} from a SPA is not. A cookie with
- * no {@code SameSite} attribute is treated as {@code Lax}.</li>
+ * no {@code SameSite} attribute is treated as {@code Lax} &mdash; by Chromium-based browsers.
+ * Firefox has not enabled Lax-by-default on its release channel, so it still treats an absent
+ * attribute as unrestricted. This jar models the Chromium behaviour, because that is the one
+ * a deployment has to survive.</li>
  * </ul>
  *
  * <p>Feeding the real {@code Set-Cookie} headers the application emits through this jar is what
@@ -119,7 +122,9 @@ public final class SpecCookieJar {
 	}
 
 	private static boolean willSend(StoredCookie cookie, Context context, boolean safeMethod) {
-		// No SameSite attribute means Lax, which is where the modern default bites.
+		// No SameSite attribute means Lax in Chromium-based browsers, which is where the modern
+		// default bites. Firefox's release channel still treats an absent attribute as
+		// unrestricted; modelling the stricter of the two is the useful choice.
 		String effective = (cookie.sameSite() == null) ? "Lax" : cookie.sameSite();
 		return switch (context) {
 			case SAME_SITE -> true;