hobokenchicken
a8cb5c5933
SameSite=None requires Secure=true or modern browsers silently reject the Set-Cookie header. Since the site is served over HTTPS via Caddy, this was causing login to succeed (200) but the session cookie to be dropped, making the subsequent /auth/me call fail with 401. SameSite=Lax is the correct setting for same-origin session cookies.
25 lines
539 B
Go
25 lines
539 B
Go
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
// SetSessionCookie writes the session cookie with secure defaults.
|
|
// Shared by password login, registration, and WebAuthn login.
|
|
func SetSessionCookie(w http.ResponseWriter, cookieName, token string, duration time.Duration) {
|
|
secure := os.Getenv("COOKIE_SECURE") != "false"
|
|
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: cookieName,
|
|
Value: token,
|
|
Path: "/",
|
|
HttpOnly: true,
|
|
Secure: secure,
|
|
SameSite: http.SameSiteLaxMode,
|
|
MaxAge: int(duration.Seconds()),
|
|
})
|
|
}
|
|
|