MM-53147 Support for embedding Mattermost in an MSTeams iframe (#23776)

* add teams to allowed frame-ancestors

* fix unit tests

* set SameSite attribute for session cookie

* further restrict ancestors

* skip landing page if in iframe

* Only set cookie SameSite=None if embedded in iframe

* don't set MMEMBED cookie on landing page (check only)

* fully parse MMEMBED cookie

* add comment

* more comments

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/utils/api.go

@@ -41,6 +41,16 @@ func OriginChecker(allowedOrigins string) func(*http.Request) bool {
 	}
 }
 
+// CheckEmbeddedCookie returns true if the MMEMBED cookie is set to 1.
+// MMEMBED is set via any plugin that facilitates Mattermost embedded in an iframe (e.g. mattermost-plugin-msteams-sync).
+func CheckEmbeddedCookie(r *http.Request) bool {
+	cookie, err := r.Cookie("MMEMBED")
+	if err != nil {
+		return false
+	}
+	return cookie.Value == "1"
+}
+
 func RenderWebAppError(config *model.Config, w http.ResponseWriter, r *http.Request, err *model.AppError, s crypto.Signer) {
 	RenderWebError(config, w, r, err.StatusCode, url.Values{
 		"message": []string{err.Message},