From c56b44ec985df684495db26064da88a25447225d Mon Sep 17 00:00:00 2001
From: Lari Taskula <lari.taskula@hypernova.fi>
Date: Sun, 26 Oct 2025 13:40:46 +0200
Subject: [PATCH] Bug 41104: Remove -sameSite from checkauth() response headers

To test:
1. prove t/db_dependent/Auth.t
2. Observe success

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit dbf812869d2af1847b846a00cbb30624f15a1aca)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
---
 C4/Auth.pm | 1 -
 1 file changed, 1 deletion(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 0599f7b052..f9eac2059b 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1625,7 +1625,6 @@ sub checkauth {
             charset           => 'utf-8',
             cookie            => $cookie,
             'X-Frame-Options' => 'SAMEORIGIN',
-            -sameSite         => 'Lax'
         }
         ),
         $template->output;