go-pkgz / auth / 38160983808

87%

push

github

Add PartitionedCookies so an embedded app can keep an HttpOnly session (#318)

* Add PartitionedCookies for third-party (CHIPS) deployments

An auth cookie set from an embedded context is dropped by browsers
enforcing CHIPS unless it carries the Partitioned attribute. The option
threads through Opts to the token service and onto both the JWT and XSRF
cookies, and it is opt-in: nothing changes for a first-party deployment.

Partitioned only means anything alongside Secure and SameSite=None, so
setting it without Secure logs a warning instead of emitting a cookie the
browser will reject. Switching a deployment on also leaves an unpartitioned
cookie behind under the same name, so the reset path clears the legacy pair
as well as the new one.

The plumbing test exists because the token.Opts literal in NewService has
silently dropped a field twice, bd39e5e3 for SameSite and 59656e46 for
XSRFIgnoreMethods, both in diffs shaped exactly like this one: a re-indent
plus one added key. Neither failed a test, because nothing asserted the
plumbing rather than the behaviour.

The avatar assertion goes the same way: the identicon test proved a PNG
came back, not that it depended on the user, so a generator returning one
fixed image would have passed it.

* Expire the legacy cookie pair when Set writes partitioned cookies

A pair written before PartitionedCookies was turned on stays next to
the partitioned one and can be sent first, so Get keeps reading stale
claims. Set now expires it before writing the partitioned pair; that
order keeps the session in browsers that ignore the Partitioned
attribute, where each expiry addresses the same cookie as its
replacement.

58 of 58 new or added lines in 2 files covered. (100.0%)

3374 of 3882 relevant lines covered (86.91%)

10.03 hits per line