set same-site attribute when clearing session cookie (#284)

fixes #282

actix-session/CHANGES.md

@@ -1,8 +1,11 @@
 # Changes
 
 ## Unreleased - 2021-xx-xx
+- Set SameSite attribute when adding a session removal cookie. [#284]
 - Minimum supported Rust version (MSRV) is now 1.59 due to transitive `time` dependency.
 
+[#284]: https://github.com/actix/actix-extras/pull/284
+
 
 ## 0.7.1 - 2022-07-24
 - Fix interaction between session state changes and renewal. [#265]

actix-session/src/middleware.rs

@@ -444,7 +444,8 @@ fn delete_session_cookie(
 ) -> Result<(), anyhow::Error> {
     let removal_cookie = Cookie::build(config.name.clone(), "")
         .path(config.path.clone())
-        .http_only(config.http_only);
+        .http_only(config.http_only)
+        .same_site(config.same_site);
 
     let mut removal_cookie = if let Some(ref domain) = config.domain {
         removal_cookie.domain(domain)