Set secure session cookie flag on cookie-agreed

Unsure about the fix.

This would mean that the cookie isn't sent anymore on http. But that might not actually matter because we don't want this cookie to be sent anyway, it's a JS only thing.

So maybe this could actually use local storage instead? Of course we still need to support a cookie that's already set.

Before working on that, lets wait on feedback from the maintainer.

Although I'm not an expert on SameSite and Secure cookies, I would assume we need a variation of SameSite, such as SameSite=Lax, rather than Secure, which indeed would cause all non secure sites to break?

@sasanikolic, which version of Firefox threw the error that you reported?

I read up on SameSite, and it seems we can't use None, as it implies we need to add Secure as well. Question is, should we use Lax or Strict? Since there's no content in the cookie that can be abused, maybe we can go for Lax? It would be beneficial in the event should some site for whatever reason want to share the cookie allowed state with another site?

I'm seeing this warning on my site. What info do you need to work on this issue?

The proposed patch introduces a Secure flag which to my knowledge seems to break sites hosted on http. It's unclear to me whether we would like to use Lax or Strict or leave it up to the admin user to make a decision. I'll see if I can provide a patch that uses "Strict" and we can test that as a starter.

@ssteigen can you let me know if you see this warning in all browsers?

I have made a patch for D8. Is that okay, or do you need one for D7?
For D7 more work is involved, as we will have to replace jquery-cookie with a different library. I couldn't find an immediate solution and will have to return to this later for D7.

For D8, can you take a look at this patch, try to apply it and see if it fixes your issue?

Here's a patch for d7.

Actually, re-reading my comment in #10, I see now we can't use the patch in #11. Hiding it.

Patch for d8 is working fine after applying the patch, it's not affecting the correct functionality and setting sameSite attribute.