greeneclipseandClaude Fable 5
6facfbb0aa
Browsers that logged in before the session cookie became Domain-scoped still hold the old host-only descrybe_session for api.descrybe.io. They then send BOTH cookies — older (stale) first — and Go reads the first match, so the stale relic shadows the fresh Domain cookie and every request 401s even immediately after a successful login. Clearing browser cookies fixed it manually; users should never have to. New DedupeSessionCookies middleware (mounted before scs LoadAndSave): when duplicate session cookies arrive, pick the token that resolves in the session store, rewrite the Cookie header to just that one, expire the host-only relic (Set-Cookie without Domain only touches the host-only variant), and re-issue the surviving token on the canonical Domain cookie. One request converges the browser to a single cookie. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
107 lines
3.2 KiB
Go
107 lines
3.2 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/alexedwards/scs/v2"
|
|
"github.com/descrybe/descrybe-v2/apps/api/internal/config"
|
|
)
|
|
|
|
func dedupeTestServer(t *testing.T) (*Server, *scs.SessionManager) {
|
|
t.Helper()
|
|
sm := scs.New() // in-memory store
|
|
return &Server{
|
|
Config: config.Config{
|
|
SessionCookieName: "descrybe_session",
|
|
WebOrigin: "https://descrybe.io",
|
|
PublicAPIURL: "https://api.descrybe.io",
|
|
SessionIdleHours: 24,
|
|
},
|
|
Sessions: sm,
|
|
}, sm
|
|
}
|
|
|
|
func TestDedupeSessionCookies_staleShadowsValid(t *testing.T) {
|
|
t.Parallel()
|
|
s, sm := dedupeTestServer(t)
|
|
if err := sm.Store.Commit("valid-token", []byte("x"), time.Now().Add(time.Hour)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
var seen string
|
|
h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
c, err := r.Cookie("descrybe_session")
|
|
if err != nil {
|
|
t.Fatalf("session cookie missing downstream: %v", err)
|
|
}
|
|
seen = c.Value
|
|
if n := len(r.Cookies()); n != 2 { // csrf + single session cookie
|
|
t.Fatalf("cookies=%d want 2 (%v)", n, r.Cookies())
|
|
}
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
|
|
// Browser order: older (stale host-only) cookie first — it used to shadow
|
|
// the fresh Domain cookie and 401 every request.
|
|
req.Header.Set("Cookie", "descrybe_session=stale-relic; descrybe_csrf=tok; descrybe_session=valid-token")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
|
|
if seen != "valid-token" {
|
|
t.Fatalf("downstream token=%q want valid-token", seen)
|
|
}
|
|
res := rec.Result()
|
|
var deleted, reissued bool
|
|
for _, c := range res.Cookies() {
|
|
if c.Name != "descrybe_session" {
|
|
continue
|
|
}
|
|
if c.MaxAge < 0 && c.Domain == "" {
|
|
deleted = true // host-only relic expired
|
|
}
|
|
if c.Value == "valid-token" && c.Domain == "descrybe.io" && c.MaxAge > 0 {
|
|
reissued = true // surviving token re-issued on the parent domain
|
|
}
|
|
}
|
|
if !deleted || !reissued {
|
|
t.Fatalf("want host-only deletion + domain re-issue, got %v", res.Cookies())
|
|
}
|
|
}
|
|
|
|
func TestDedupeSessionCookies_singleCookieUntouched(t *testing.T) {
|
|
t.Parallel()
|
|
s, _ := dedupeTestServer(t)
|
|
h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if c, err := r.Cookie("descrybe_session"); err != nil || c.Value != "only-one" {
|
|
t.Fatalf("cookie changed: %v %v", c, err)
|
|
}
|
|
}))
|
|
req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
|
|
req.Header.Set("Cookie", "descrybe_session=only-one")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if n := len(rec.Result().Cookies()); n != 0 {
|
|
t.Fatalf("single cookie must not trigger Set-Cookie, got %v", rec.Result().Cookies())
|
|
}
|
|
}
|
|
|
|
func TestDedupeSessionCookies_noValidTokenKeepsNewest(t *testing.T) {
|
|
t.Parallel()
|
|
s, _ := dedupeTestServer(t)
|
|
var seen string
|
|
h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
c, _ := r.Cookie("descrybe_session")
|
|
seen = c.Value
|
|
}))
|
|
req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
|
|
req.Header.Set("Cookie", "descrybe_session=old-stale; descrybe_session=new-stale")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if seen != "new-stale" {
|
|
t.Fatalf("want newest cookie kept, got %q", seen)
|
|
}
|
|
}
|