strict samesite instead of lax

models/pages/captcha.js

@@ -19,7 +19,7 @@ module.exports = async (req, res, next) => {
 			'maxAge': 5*60*1000, //5 minute cookie
 			'httpOnly': true,
 			'secure': true,
-			'sameSite': 'lax'
+			'sameSite': 'strict'
 		})
 		.redirect(`/captcha/${captchaId}.jpg`);
 

server.js

@@ -42,7 +42,7 @@ const express = require('express')
 		cookie: {
 			httpOnly: true,
 			secure: true,
-			sameSite: 'lax',
+			sameSite: 'strict',
 		}
 	}));