Can't set SameSite=Strict cookie attribute

Fixed typo.

That makes sense, yeah. In this case it's more that it doesn't seem to even be doing that, in that the cookie is set with Lax even though my container parameters are:

[
  "gc_probability" => 1
  "gc_divisor" => 100
  "gc_maxlifetime" => 200000
  "cookie_lifetime" => 0
  "cookie_domain" => ""
  "cookie_samesite" => "Strict"
  "sid_length" => 48
  "sid_bits_per_character" => 6
]

As far as I can tell, it looks like \Symfony\Component\HttpFoundation\Cookie::create() has the parameter $sameSite = self::SAMESITE_LAX, and you explicitly create an instance in \Drupal\persistent_login\EventSubscriber\TokenHandler::setTokenOnResponseEvent() like so:

      $response->headers->setCookie(
        Cookie::create(
          $this->cookieHelper->getCookieName($request),
          $this->token,
          $this->token->getExpiry(),
          '/', // @todo Path should probably match the base path.
          $sessionOptions['cookie_domain'],
          $sessionOptions['cookie_secure']
        )
      );

...which I'm assuming defaults to $sameSite = self::SAMESITE_LAX because you didn't provide the $sameSite parameter and it's using the default value hard coded into that Symfony class rather than automagically using the container parameters.

The quick fix would be to just get the cookie_samesite container parameter and pass it explicitly to \Symfony\Component\HttpFoundation\Cookie::create().

I could throw together a test to demonstrate this if you'd like. Either it turns out I'm doing something dumb (entirely possible), or this is a legit issue with this module that's flown under the radar because most people haven't tried to harden cookies with these attributes.

Had this rattling around in my brain the other day and realized a better way to summarize what's probably going on here: the container session parameters very likely only apply to the cookie that identifies the session to Symfony/Drupal, not any other cookies; cookies that are set to expire with the session aren't the same thing, and Symfony doesn't know you want the same behaviour as the session identifier cookie because as far as it knows, you're setting a cookie that has little to do with the session itself.

Heck yeah. Glad to be of help!