go-pkgz / auth / 33853174974

87%

master: 87%

Pull #318

github

Add PartitionedCookies for third-party (CHIPS) deployments

An auth cookie set from an embedded context is dropped by browsers
enforcing CHIPS unless it carries the Partitioned attribute. The option
threads through Opts to the token service and onto both the JWT and XSRF
cookies, and it is opt-in: nothing changes for a first-party deployment.

Partitioned only means anything alongside Secure and SameSite=None, so
setting it without Secure logs a warning instead of emitting a cookie the
browser will reject. Switching a deployment on also leaves an unpartitioned
cookie behind under the same name, so the reset path clears the legacy pair
as well as the new one.

The plumbing test exists because the token.Opts literal in NewService has
silently dropped a field twice, bd39e5e3 for SameSite and 59656e46 for
XSRFIgnoreMethods, both in diffs shaped exactly like this one: a re-indent
plus one added key. Neither failed a test, because nothing asserted the
plumbing rather than the behaviour.

40 of 46 new or added lines in 2 files covered. (86.96%)

3317 of 3831 relevant lines covered (86.58%)

9.76 hits per line