Fix admin login for non-secure cookies

[sreichel]

Description (*)

Setting cookie SameSite to "None" breaks admin login for unsecured pages.

• fixes Install magento-lts-20.14.0 with ip address issue #4855
• fixes [BUG] no login possible post-Update 20.13.0 -> 20.14.0 (and still 20.15.0) #4908

Related PR

• see Use sameSite setting in the session cookie #4827

[Copilot]

Pull Request Overview

This PR fixes admin login issues when using non-secure cookies by preventing the SameSite attribute from being set to "None" for non-HTTPS connections, which is incompatible with browser security requirements.

• Adds logic to conditionally remove SameSite=None for non-secure cookies in session handling
• Introduces constants for SameSite cookie values to improve code maintainability
• Updates cookie handling to use consistent constant references instead of hardcoded strings

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
app/code/core/Mage/Adminhtml/Model/System/Config/Source/Cookie/Samesite.php	Adds constants for SameSite values (NONE, STRICT, LAX) and updates option array to use them
app/code/core/Mage/Core/Model/Cookie.php	Updates cookie methods to use SameSite constants and improves type hints and documentation
app/code/core/Mage/Core/Model/Session/Abstract/Varien.php	Adds conditional logic to remove SameSite=None for non-secure cookies and fixes namespace references
tests/unit/Mage/Core/Model/CookieTest.php	Adds comprehensive unit tests for the Cookie model functionality

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sreichel]

Only one notable change: delete param and fallback to browser default.

        if (!$cookie->isSecure() && $cookieParams['samesite'] === CookieSamesite::NONE) {
            // PHP doesn't allow to set SameSite=None for non-secure cookies
            unset($cookieParams['samesite']);
        }

Merged.