go-pkgz / auth / 38161877566

87%

push

github

fix: set HttpOnly on the JWT removal cookie in Reset

Set writes the JWT cookie with HttpOnly and Reset expired it without.
Chromium rejects any Set-Cookie for a __Http- or __Host-Http- prefixed
name that lacks HttpOnly, the expiry included, so with such a
JWTCookieName logout left the session cookie in place. With
PartitionedCookies on, the unpartitioned form was cleared and the
partitioned one survived.

the removal header gains "; HttpOnly" for every deployment. Cookie
identity is name, domain and path, so it still replaces the cookie.

2 of 2 new or added lines in 1 file covered. (100.0%)

3344 of 3849 relevant lines covered (86.88%)

9.96 hits per line