Clojurians Log v2

I have a weird issue where redirects from Instagram are blowing away my session cookies. What's really weird is that logging in from the same tab as the fresh redirect, then refreshing will also blow it away. Only when I open a new tab my session will start sticking again. Googling anything similar doesn't show anything, any ideas? Here's the relevant ring code:

(defn wrap-base [handler]
  (-> ((:middleware defaults) handler)
      (wrap-defaults
       (-> site-defaults
           (assoc-in [:session :store] (cookie-store {:key "(censored-out)"}))
           (assoc-in [:session :cookie-attrs :max-age] (encore/secs :years 5))
           (assoc-in [:session :cookie-name] "sayartii")))
      wrap-flash
      wrap-context
      wrap-internal-error))

Refreshing the tab will constantly change the session cookie on the instagram redirected tab, but a normal tab it will stay as is.

Seems consistent across browsers too, was first found out on iOS Safari

Found it: https://github.com/ring-clojure/ring-defaults/blob/master/src/ring/middleware/defaults.clj#L45 same-site strict causes this. https://www.netsparker.com/blog/web-security/same-site-cookie-attribute-prevent-cross-site-request-forgery/#:~:text=When%20the%20SameSite%20attribute%20is,can%20affect%20browsing%20experience%20negatively.&text=Only%20in%20this%20way%2C%20the,as%20LAX%20will%20be%20sent.