Fix #3622: Ensure SameSite is Lax when null is provided to DefaultCookieSerializer

spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java

@@ -40,6 +40,7 @@
  * @author Rob Winch
  * @author Vedran Pavic
  * @author Eddú Meléndez
+ * @author Khyojae
  * @since 1.1
  */
 public class DefaultCookieSerializer implements CookieSerializer {
@@ -410,6 +411,10 @@ public void setRememberMeRequestAttribute(String rememberMeRequestAttribute) {
 	 * @since 2.1.0
 	 */
 	public void setSameSite(String sameSite) {
+		if (sameSite == null) {
+			this.sameSite = "Lax";
+			return;
+		}
 		this.sameSite = sameSite;
 	}
 

spring-session-core/src/test/java/org/springframework/session/web/http/DefaultCookieSerializerTests.java

@@ -45,6 +45,7 @@
  * @author Rob Winch
  * @author Vedran Pavic
  * @author Eddú Meléndez
+ * @author Khyojae
  */
 class DefaultCookieSerializerTests {
 
@@ -460,6 +461,22 @@ void writeCookieSetSameSiteNull() {
 		assertThat(getCookie().getSameSite()).isNull();
 	}
 
+
+
+
+	@Test
+	void writeCookieShouldUseDefaultSameSiteWhenNotSet() {
+		DefaultCookieSerializer serializer = new DefaultCookieSerializer();
+		serializer.setSameSite(null);
+
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		serializer.writeCookieValue(new CookieValue(request, response, "test-id"));
+
+		assertThat(response.getHeader("Set-Cookie")).contains("SameSite=Lax");
+	}
+
+
 	void setCookieName(String cookieName) {
 		this.cookieName = cookieName;
 		this.serializer.setCookieName(cookieName);