fix: explicitly set sameSite: strict for OIDC correlation cookies

server/routes/auth.ts

@@ -708,6 +708,7 @@ authRoutes.get('/oidc/login/:slug', async (req, res, next) => {
     httpOnly: true,
     secure: req.protocol === 'https',
     signed: true,
+    sameSite: 'strict',
   });
 
   const callbackUrl = getOidcRedirectUrl(req);
@@ -726,6 +727,7 @@ authRoutes.get('/oidc/login/:slug', async (req, res, next) => {
     httpOnly: true,
     secure: req.protocol === 'https',
     signed: true,
+    sameSite: 'strict',
   });
 
   let redirectUrl: URL;