Impossible to distinguish between unspecified SameSite and SameSite=None

[flotwig]

Currently, both of these calls will result in a cookie with sameSite: 'none':

> tough.parse('foo=bar').sameSite
'none'
> tough.parse('foo=bar; SameSite=None').sameSite
'none'

This means we can't distinguish between SameSite=None and no SameSite declaration at all.

This causes problems when attempting to set a default SameSite that is not 'none'. For example, when trying to emulate the behavior of Chrome and Firefox (both of which are moving towards SameSite=Lax as the default for an unspecified SameSite attribute), it's impossible to tell if the default behavior should be applied, or if the Set-Cookie explicitly passed None, because both result in sameSite: 'none'.

For now, I'm using a workaround like this to determine if SameSite is really unspecified or if it's explicitly None:

const sameSiteNoneRe = /; +samesite=(?:'none'|"none"|none)/i
const cookie = tough.parse(setCookieHeader)
const hasUnspecifiedSameSite = cookie.sameSite === 'none' && !sameSiteNoneRe.test(setCookieHeader)

[ShivanKaul]

Hey @flotwig, this makes sense. We're going to work on this. Sorry for the delay!