Repository: streamlit/streamlit

Issue:
Misconfigured _xsrf cookies
### Checklist

- [X] I have searched the [existing issues](https://github.com/streamlit/streamlit/issues) for similar issues.
- [X] I added a very descriptive title to this issue.
- [X] I have provided sufficient information below to help reproduce this issue.

### Summary

Hi,

I am running a Streamlit app on Azure, requiring authentication with AD, and `st.file_uploader` returns a 403 Forbidden error if `enableXsrfProtection` is on. It works locally, and I suspect that this is caused by the _xsrf cookie not getting though, because I can see the cookie in dev tools locally, but not when deployed.

In particular, the cookie is missing the SameSite and Secure attributes.

### Reproducible Code Example

_No response_

### Steps To Reproduce

1. Open any Streamlit app
2. Open browser developer tools

### Expected Behavior

Cookies have `SameSite=None; Secure` attribute.

### Current Behavior

_xsrf cookie is not transmitted when deployed on the cloud with SSO and HTTPS-only.

Locally this is what I am getting:
![image](https://user-images.githubusercontent.com/19314272/204801462-8a387f12-3df5-46e7-a9f6-69bd5293733d.png)

Plus the deprecation warning:

>Some cookies are misusing the recommended “SameSite“ attribute
>Cookie “_xsrf” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

### Is this a regression?

- [ ] Yes, this used to work in a previous version.

### Debug info

- Streamlit version: 1.15.0
- Python version: 3.10, 3.11
- Operating System: Ubuntu 22.04 (WSL)
- Browser: Firefox, Chrome
- Virtual environment: yes


### Additional Information

This has been touched on in https://github.com/streamlit/streamlit/issues/2517 and particularly https://github.com/streamlit/streamlit/issues/2517#issuecomment-1321281460. Feel free to close if you consider this is a duplicate, but I believe that the cookie configuration and Streamlit overwriting Jupyter's cookies are two different issues.

There are multiple reports of this on the forum:

https://discuss.streamlit.io/t/deployment-on-azure-ad-authentication-enabled-st-file-uploader-403-forbidden/30898

https://discuss.streamlit.io/t/azure-ad-xsrf-protection-and-st-file-uploader/33612

https://discuss.streamlit.io/t/deployment-on-azure-appservice-ad-authentication-enabled-st-file-uploader-403-forbidden/5839

https://discuss.streamlit.io/t/file-uploader-403-error-when-embedding-streamlit-app-in-iframe/24109

Whether they all have the same underlying cause, I cannot tell.

### Are you willing to submit a PR?

- [ ] Yes, I am willing to submit a PR!


Discussion:
Hi @matkozak Thanks for the report! I'll do some investigation on this one!

Resolving patch:
diff --git a/lib/streamlit/web/server/server.py b/lib/streamlit/web/server/server.py
--- a/lib/streamlit/web/server/server.py
+++ b/lib/streamlit/web/server/server.py
@@ -70,6 +70,7 @@
     # If we don't get a ping response within 30s, the connection
     # is timed out.
     "websocket_ping_timeout": 30,
+    "xsrf_cookie_kwargs": {"secure": True, "samesite": "None"},
 }
 
 # When server.port is not available it will look for the next available port


Test patch: