sneak
02ca16a68a
All checks were successful
check / check (push) Successful in 2m4s
Resolve the two remaining gosec G124 findings (internal/session/ session.go:84 and :128): session cookies are now unconditionally Secure, HttpOnly, and SameSite=Strict on both the CreateSession set-cookie path and the ClearSession delete-cookie path. gosec requires these attributes to be constant, and there is no legitimate configuration in which the authentication cookie should be weaker, so the former secure toggle (wired to !config.Debug) is removed rather than kept as a variable. The toggle parameter on NewManager is retained as an ignored blank parameter so existing call sites (including tests) keep compiling; removing it is tracked as a Future Step in TODO.md. Local development over http://localhost keeps working because browsers treat localhost as a trustworthy origin and accept Secure cookies there. Update TODO.md per its Workflow section: record this step as completed, promote the manual auth/URL-flow test pass to Next Step, and correct the stale Status text (make check is now green).