update zrok_session cookie to work with XHR

endpoints/dynamicProxy/http.go

@@ -117,6 +117,11 @@ func newServiceProxy(cfg *config, ctx ziti.Context, mappings *mappings) (*httput
 		req.Header.Set("X-Proxy", "zrok")
 	}
 	proxy.ModifyResponse = func(resp *http.Response) error {
+		origin := resp.Request.Header.Get("Origin")
+		// CORS will block the zrok_session cookie for XHR requests if the server sends responds with *
+		if origin != "" && resp.Header.Get("Access-Control-Allow-Origin") == "*" {
+			resp.Header.Set("Access-Control-Allow-Origin", origin)
+		}
 		return nil
 	}
 	proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {

endpoints/oauthCookies.go

@@ -173,13 +173,13 @@ func SetSessionCookie(w http.ResponseWriter, cookieName string, tokenValue strin
 
 	// common cookie attributes
 	cookieAttrs := &http.Cookie{
-		MaxAge:  int(cfg.GetSessionLifetime().Seconds()),
-		Domain:  cfg.GetCookieDomain(),
-		Path:    "/",
-		Expires: time.Now().Add(cfg.GetSessionLifetime()),
-		// Secure:  true, // pending server tls feature https://github.com/openziti/zrok/issues/24
-		HttpOnly: true,                 // enabled because zrok frontend is the only intended consumer of this cookie, not client-side scripts
-		SameSite: http.SameSiteLaxMode, // explicitly set to the default Lax mode which allows the zrok share to be navigated to from another site and receive the cookie
+		MaxAge:   int(cfg.GetSessionLifetime().Seconds()),
+		Domain:   cfg.GetCookieDomain(),
+		Path:     "/",
+		Expires:  time.Now().Add(cfg.GetSessionLifetime()),
+		Secure:   true,
+		HttpOnly: true,                  // enabled because zrok frontend is the only intended consumer of this cookie, not client-side scripts
+		SameSite: http.SameSiteNoneMode, // None required so cross-origin XHR/fetch requests with withCredentials include the cookie
 	}
 
 	// check if we need to stripe the cookie

endpoints/publicProxy/http.go

@@ -113,6 +113,11 @@ func newServiceProxy(cfg *Config, ctx ziti.Context) (*httputil.ReverseProxy, err
 		req.Header.Set("X-Proxy", "zrok")
 	}
 	proxy.ModifyResponse = func(resp *http.Response) error {
+		origin := resp.Request.Header.Get("Origin")
+		// CORS will block the zrok_session cookie for XHR requests if the server sends responds with *
+		if origin != "" && resp.Header.Get("Access-Control-Allow-Origin") == "*" {
+			resp.Header.Set("Access-Control-Allow-Origin", origin)
+		}
 		return nil
 	}
 	proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {