Set secure policy on antiforgery cookie to always (#1052)

* Set secure policy on antiforgery cookie to always

* Only include secure policy if base url begins with https

* Replace config with using base url generator

---------

Co-authored-by: James Sibbit <james.sibbit@d-fine.com>

backend/src/Squidex/Areas/IdentityServer/Config/IdentityServerServices.cs

@@ -126,6 +126,14 @@ public static class IdentityServerServices
             var identityOptions = c.GetRequiredService<IOptions<MyIdentityOptions>>().Value;
 
             options.SuppressXFrameOptionsHeader = identityOptions.SuppressXFrameOptionsHeader;
+
+            // Set antiforgery cookie secure policy to always for https
+            var baseUrl = c.GetRequiredService<IUrlGenerator>().BuildUrl();
+
+            if (baseUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
+            {
+                options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+            }
         });
 
         services.Configure<OpenIddictServerOptions>((c, options) =>