fix(hub): preserve browser OIDC session handoff

[gnanirahulnutakki]

Summary

• change the final browser OIDC session cookie from SameSite=Strict to explicit SameSite=Lax
• preserve the new session across the safe top-level console redirect that began at the external IdP
• lock out unsafe login and callback methods with a focused regression
• document the exact interoperability and CSRF boundary in the root and chart READMEs

Root cause and security boundary

RFC6265bis withholds Strict cookies from top-level navigations triggered by a cross-site document context. The callback could set the session cookie successfully and then redirect to a console request that did not carry it.

Lax permits the safe top-level GET hop but still excludes unsafe cross-site methods. The __Host- prefix, Secure, HttpOnly, Path=/, no Domain, bounded expiry, exact callback host/path, PKCE S256, state, nonce, single-use transaction, no return URL, server-side token exchange, and cookie exclusion from bearer APIs remain unchanged. Console data reads retain their purpose-bound custom same-origin proof.

Primary source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#samesite-cookies

Verification

• focused internal/hubserver race suite: 10 consecutive passes
• make ci: pass; zero lint findings and no reachable Go vulnerabilities
• make e2e-isolation: pass; forced PostgreSQL RLS plus both 50,000-execution tenant fuzzers
• make release-check: pass; reproducible archives, SPDX SBOM, formula, and release-derived multi-platform OCI layout
• Helm 4.2.3 chart contract and standalone OCI contract: pass
• real Kubernetes v1.36.1 two-cluster Kind suite: pass in 241.176 seconds
• Trivy secret scan: zero findings
• CodeRabbit exact uncommitted four-file review: zero findings
• external QA kubeconfig: not used

Immutable identity

• base: ea6dff314cc4eb4e9054dc41a42d53651e5a1bcc
• signed DCO/GSTACK head: 277277ec34a0fe9f82a50ab7db54258962970b7d
• commit author: gnani.nutakki@gmail.com

Closes #309

Part of #26

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3195eef2-ce3f-40fd-9611-45750a7f89c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/fix-oidc-session-handoff-20260722

---

_{Comment @coderabbitai help to get the list of available commands.}