go-pkgz / auth / 38161668778

87%

master: 87%

Pull #320

github

fix: set HttpOnly on the JWT removal cookie in Reset

Set writes the JWT cookie with HttpOnly and Reset expired it without.
Chromium rejects any Set-Cookie for a __Http- or __Host-Http- prefixed
name that lacks HttpOnly, the expiry included, so with such a
JWTCookieName logout left the session cookie in place. With
PartitionedCookies on, the unpartitioned form was cleared and the
partitioned one survived.

the removal header gains "; HttpOnly" for every deployment. Cookie
identity is name, domain and path, so it still replaces the cookie.

2 of 2 new or added lines in 1 file covered. (100.0%)

3375 of 3883 relevant lines covered (86.92%)

10.03 hits per line