cgalo5758
0b28a9dc29
- Replace gorilla/csrf with net/http CrossOriginProtection - Require valkey-password and add TLS options for session store - End session at /logout and revoke refresh tokens - Re-derive identity and roles from provider every five minutes - Process each Stripe webhook event in its own Temporal workflow - Give each outbox entry its own workflow with Temporal retries - Guard against stale Stripe events with provider timestamps - Derive transport security from base-url scheme
44 lines
1.4 KiB
Go
44 lines
1.4 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
|
|
// SPDX-FileCopyrightText: 2025-2026 Christian Galo
|
|
|
|
package auth
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/alexedwards/scs/v2"
|
|
"github.com/spf13/viper"
|
|
)
|
|
|
|
// Finding 5 of the 2026-09 security audit: the session cookie was Secure only
|
|
// when env was exactly "production", so a TLS deployment under any other label
|
|
// shipped the cookie without it. It now follows base-url's scheme, the one
|
|
// declaration of the transport the browser sees.
|
|
func TestSessionCookieSecureFollowsTheBaseURLScheme(t *testing.T) {
|
|
t.Cleanup(viper.Reset)
|
|
for _, tc := range []struct {
|
|
name string
|
|
baseURL string
|
|
env string
|
|
want bool
|
|
}{
|
|
{"https, labelled production", "https://console.example.coop", "production", true},
|
|
{"https, labelled staging", "https://console.example.coop", "staging", true},
|
|
{"https, labelled development", "https://console.example.coop", "development", true},
|
|
{"plain http for local work", "http://member-console.localhost:9431", "development", false},
|
|
{"plain http mislabelled production", "http://localhost:8081", "production", false},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
viper.Set("base-url", tc.baseURL)
|
|
viper.Set("env", tc.env)
|
|
sm := newSessionManager(scs.New().Store)
|
|
if sm.Cookie.Secure != tc.want {
|
|
t.Errorf("Cookie.Secure = %v, want %v", sm.Cookie.Secure, tc.want)
|
|
}
|
|
if !sm.Cookie.HttpOnly {
|
|
t.Error("Cookie.HttpOnly must stay set")
|
|
}
|
|
})
|
|
}
|
|
}
|