greeneclipseandClaude Fable 5
0eef202f56
Production splits web (descrybe.io) and API (api.descrybe.io). The session cookie was host-only for api.descrybe.io, so the browser never sent it to the web host. The /admin SvelteKit SSR gate (fetchMeStaff in +layout.server.ts) forwards the incoming cookie header to /api/auth/me — with no cookie to forward it always got 401 and bounced every successful login back to /login?next=/admin (login POST 200, /me 200 from the browser, /me 401 from the web server). New SESSION_COOKIE_DOMAIN env (default empty = host-only, local dev unchanged) sets the session cookie Domain attribute; set it to the parent domain (descrybe.io) in production so both hosts receive the cookie. Leading dot is normalized away. CSRF needs no change — it already seeds cross-origin via the X-CSRF-Token response header. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
56 lines
1.5 KiB
Go
56 lines
1.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestNewSessionManagerCookieFlags(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
sm := NewSessionManager(nil, "descrybe_session", "", true, 12)
|
|
if sm.Cookie.Name != "descrybe_session" {
|
|
t.Fatalf("Name = %q", sm.Cookie.Name)
|
|
}
|
|
if sm.Cookie.Domain != "" {
|
|
t.Fatalf("Domain = %q, want host-only default", sm.Cookie.Domain)
|
|
}
|
|
if !sm.Cookie.HttpOnly {
|
|
t.Fatal("session cookie must be HttpOnly")
|
|
}
|
|
if !sm.Cookie.Secure {
|
|
t.Fatal("secure=true must set Secure")
|
|
}
|
|
if sm.Cookie.SameSite != http.SameSiteLaxMode {
|
|
t.Fatalf("SameSite = %v, want Lax", sm.Cookie.SameSite)
|
|
}
|
|
if sm.Cookie.Path != "/" {
|
|
t.Fatalf("Path = %q, want /", sm.Cookie.Path)
|
|
}
|
|
if sm.IdleTimeout != 12*time.Hour {
|
|
t.Fatalf("IdleTimeout = %v, want 12h", sm.IdleTimeout)
|
|
}
|
|
if sm.Lifetime != 7*24*time.Hour {
|
|
t.Fatalf("Lifetime = %v, want 7d", sm.Lifetime)
|
|
}
|
|
|
|
insecure := NewSessionManager(nil, "descrybe_session", "", false, 0)
|
|
if insecure.Cookie.Secure {
|
|
t.Fatal("secure=false must not set Secure")
|
|
}
|
|
if !insecure.Cookie.HttpOnly {
|
|
t.Fatal("session cookie must remain HttpOnly")
|
|
}
|
|
if insecure.IdleTimeout != 24*time.Hour {
|
|
t.Fatalf("default IdleTimeout = %v, want 24h", insecure.IdleTimeout)
|
|
}
|
|
|
|
// Parent-domain deploys (descrybe.io + api.descrybe.io): leading dot is
|
|
// normalized away; browsers include subdomains whenever Domain is set.
|
|
scoped := NewSessionManager(nil, "descrybe_session", ".descrybe.io", true, 12)
|
|
if scoped.Cookie.Domain != "descrybe.io" {
|
|
t.Fatalf("Domain = %q, want descrybe.io", scoped.Cookie.Domain)
|
|
}
|
|
}
|