sneak ca15f52dcc test: require Secure/HttpOnly/SameSite on all session cookies ...

Add a failing test asserting that every cookie written by the session
manager (both the CreateSession set-cookie path and the ClearSession
delete-cookie path) carries HttpOnly, Secure, and a SameSite mode of
Lax or stricter, regardless of constructor arguments. Session cookies
carry authentication state and must never be sent over plaintext HTTP.

Currently fails for the constructor secure=false case, which produces
cookies without the Secure attribute (gosec G124 at
internal/session/session.go:84 and :128).

2026-08-07 21:02:07 +07:00

2.5 KiB

Raw Blame History

View Raw