go-pkgz / auth / 32674835521

86%

master: 86%

Pull #318

github

Address review: scope the claim, clear legacy cookies, warn on missing Secure

The description and the godoc claimed this unblocks a framed
deployment's OAuth. It does not, and for the common case it is worse
than neutral: the partition key is the top-level site at the moment the
cookie is set, an OAuth popup is its own top-level context, so a
callback cookie is keyed to the auth site and the frame never sees it.
Where unpartitioned third-party cookies are still allowed, enabling the
flag turns a working OAuth session into an invisible one. Both godocs
now say so, and point at requestStorageAccess or a one-shot code
exchanged inside the frame as the application-side routes. The feature
is real for direct, telegram and the email-code flow, where Set runs
inside the frame, and that is what it now claims.

Reset also has to clear the unpartitioned pair. A partitioned expiry
does not match a cookie stored before the option was turned on; the
browser then sends both, sorted oldest first, and Request.Cookie returns
the first, so Get reads the legacy one. It is expired but validly
signed, so the refresh path turns it back into a live session. The
/reset subtest now asserts four headers, two of each form.

PartitionedCookies without SecureCookies produces a cookie
http.Cookie.Valid rejects, but SetCookie writes through String and never
calls Valid, so the header goes out, browsers drop both cookies and the
login silently produces no session. Warned at construction rather than
forced, since overriding an explicit SecureCookies: false would be
worse.

And the godoc had SameSite wrong: Valid gates on Secure alone, while
SameSite=None is what makes the cookie get sent from a third-party
frame.

Four byte-count sites were missed in the first pass, in the dev and
custom provider tests in both modules. They assert the generator's
300x300 geometry now, which no Go release moves, rather than an encoded
length. Worth noting CI cannot see this class at all: both workflo... (continued)

40 of 46 new or added lines in 2 files covered. (86.96%)

3230 of 3755 relevant lines covered (86.02%)

9.61 hits per line