Repository: auth0/nextjs-auth0 (ts)

Issue:
Checks.state argument is missing when trying to sign in inside an IFrame
### Description

> I am facing the error `Checks.state argument is missing` when i try sign in inside an IFrame. I checked some similar errors where env variables were misconfigured, but i think this is not my case since the authentication flow works fine in outside IFrame.

> The problem happens in the first login attempt, if the user already is logged the redirect works as expected.

### Reproduction

> - Create an application and install @auth0/nextjs-auth0
> - Setup environment variables 
> - Instantiate application inside an IFrame
> - Sign in

### Environment

> Please provide the following:

- **Version of this library used:** 1.5.0
- **Next JS version:** 11.1.0


Pull request:
Honor configured sameSite in transient cookies so you can login to iframe using 'none'
### Description

Honor the `SameSite` configuration (which defaults to 'lax') when setting the transient nonce/state cookies.

This will allow users to login to iframes over https when using the [AUTH0_COOKIE_SAME_SITE](https://auth0.github.io/nextjs-auth0/interfaces/config.cookieconfig.html#samesite) config set to `'none'`

### References

Same as https://github.com/auth0/express-openid-connect/pull/188
fixes #541 

### Testing

Tested by logging in to auth0 from an iframe in https://codepen.io/adamjmcgrath/pen/bGoKBMW

### Checklist

- [x] I have added documentation for new/changed functionality in this PR or in auth0.com/docs
- [x] All active GitHub checks for tests, formatting, and security are passing
- [x] The correct base branch is being used, if not `main`


Patch:
diff --git a/src/auth0-session/handlers/login.ts b/src/auth0-session/handlers/login.ts
index 6d78c10e..63070260 100644
--- a/src/auth0-session/handlers/login.ts
+++ b/src/auth0-session/handlers/login.ts
@@ -40,7 +40,7 @@ export default function loginHandlerFactory(
     };
 
     const transientOpts: StoreOptions = {
-      sameSite: opts.authorizationParams.response_mode === 'form_post' ? 'none' : 'lax'
+      sameSite: opts.authorizationParams.response_mode === 'form_post' ? 'none' : config.session.cookie.sameSite
     };
 
     const stateValue = await opts.getLoginState(req as any, opts);


Test patch:
diff --git a/tests/auth0-session/handlers/login.test.ts b/tests/auth0-session/handlers/login.test.ts
index 9697201d..6d2ed956 100644
--- a/tests/auth0-session/handlers/login.test.ts
+++ b/tests/auth0-session/handlers/login.test.ts
@@ -1,7 +1,7 @@
 import { parse } from 'url';
 import { CookieJar } from 'tough-cookie';
 import { setup, teardown } from '../fixtures/server';
-import { defaultConfig, fromCookieJar, get } from '../fixtures/helpers';
+import { defaultConfig, fromCookieJar, get, getCookie } from '../fixtures/helpers';
 import { decodeState, encodeState } from '../../../src/auth0-session/hooks/get-login-state';
 import { LoginOptions } from '../../../src/auth0-session';
 import { IncomingMessage } from 'http';
@@ -197,4 +197,48 @@ describe('login', () => {
     });
     await expect(get(baseURL, '/login')).rejects.toThrow('Custom state value must be an object.');
   });
+
+  it('transient cookie SameSite should default to lax in code flow', async () => {
+    const baseURL = await setup({
+      ...defaultConfig,
+      clientSecret: '__test_client_secret__',
+      authorizationParams: {
+        response_type: 'code'
+      }
+    });
+    const cookieJar = new CookieJar();
+
+    const { res } = await get(baseURL, '/login', { fullResponse: true, cookieJar });
+    expect(res.statusCode).toEqual(302);
+
+    const cookie = getCookie('state', cookieJar, baseURL);
+    expect(cookie?.sameSite).toEqual('lax');
+    expect(cookie?.secure).toBeFalsy();
+  });
+
+  it('transient cookie SameSite should honor cookie config in code flow', async () => {
+    const baseURL = await setup(
+      {
+        ...defaultConfig,
+        clientSecret: '__test_client_secret__',
+        authorizationParams: {
+          response_type: 'code'
+        },
+        session: {
+          cookie: {
+            sameSite: 'none'
+          }
+        }
+      },
+      { https: true }
+    );
+    const cookieJar = new CookieJar();
+
+    const { res } = await get(baseURL, '/login', { fullResponse: true, cookieJar });
+    expect(res.statusCode).toEqual(302);
+
+    const cookie = getCookie('state', cookieJar, baseURL);
+    expect(cookie?.sameSite).toEqual('none');
+    expect(cookie?.secure).toBeTruthy();
+  });
 });