Document the same_site changes

And explain that browsers may be more strict over TCP vs TLS.

Makefile

@@ -2,7 +2,7 @@
 
 PROJECT = cowlib
 PROJECT_DESCRIPTION = Support library for manipulating Web protocols.
-PROJECT_VERSION = 2.9.1
+PROJECT_VERSION = 2.10.0
 
 # Options.
 

doc/src/manual/cow_cookie.asciidoc

@@ -29,7 +29,7 @@ cookie_attrs() :: #{
     path => binary(),
     secure => true,
     http_only => true,
-    same_site => strict | lax
+    same_site => strict | lax | none
 }
 ----
 
@@ -48,7 +48,7 @@ cookie_opts() :: #{
     http_only => boolean(),
     max_age   => non_neg_integer(),
     path      => binary(),
-    same_site => lax | strict,
+    same_site => strict | lax | none,
     secure    => boolean()
 }
 ----
@@ -83,10 +83,14 @@ be sent to the current "directory" of the effective request URI.
 same_site::
 
 Whether the cookie should be sent along with cross-site
-requests. This header is currently non-standard but is in
+requests. This attribute is currently non-standard but is in
 the process of being standardized. Please refer to the
 https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7[RFC 6265 (bis) draft]
 for details.
++
+The default value for this attribute may vary depending on
+user agent and configuration. Browsers are known to be more
+strict over TCP compared to TLS.
 
 secure::
 
@@ -97,6 +101,8 @@ transfer. By default there are no restrictions.
 
 == Changelog
 
+* *2.10*: The `same_site` attribute and option may now be
+          set to `none`.
 * *2.9*: The `cookie_attrs` type was added.
 * *1.0*: Module introduced.
 

ebin/cowlib.app

@@ -1,6 +1,6 @@
 {application, 'cowlib', [
 	{description, "Support library for manipulating Web protocols."},
-	{vsn, "2.9.1"},
+	{vsn, "2.10.0"},
 	{modules, ['cow_base64url','cow_cookie','cow_date','cow_hpack','cow_http','cow_http2','cow_http2_machine','cow_http_hd','cow_http_struct_hd','cow_http_te','cow_iolists','cow_link','cow_mimetypes','cow_multipart','cow_qs','cow_spdy','cow_sse','cow_uri','cow_uri_template','cow_ws']},
 	{registered, []},
 	{applications, [kernel,stdlib,crypto]},

src/cow_cookie.erl

@@ -35,7 +35,7 @@
 	http_only => boolean(),
 	max_age => non_neg_integer(),
 	path => binary(),
-	same_site => lax | strict | none,
+	same_site => strict | lax | none,
 	secure => boolean()
 }.
 -export_type([cookie_opts/0]).