Function TestSessionCookieMaxAge

coderd/apikey_test.go:402–444

TestSessionCookieMaxAge verifies that the session cookie is a persistent cookie (has MaxAge set) rather than a session cookie. Standalone PWAs run in their own browser process and mobile OSes purge in-memory (session) cookies when that process is killed, so the cookie must be persisted to disk.

(t *testing.T)

// (session) cookies when that process is killed, so the cookie must be
// persisted to disk.
func TestSessionCookieMaxAge(t *testing.T) {
	t.Parallel()

	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
	defer cancel()

	client := coderdtest.New(t, nil)

	// Create the first user (password-based login).
	req := codersdk.CreateFirstUserRequest{
		Email:    "testuser@coder.com",
		Username: "testuser",
		Password: "SomeSecurePassword!",
	}
	_, err := client.CreateFirstUser(ctx, req)
	require.NoError(t, err)

	// Login via the raw HTTP endpoint so we can inspect the Set-Cookie header.
	loginURL, err := client.URL.Parse("/api/v2/users/login")
	require.NoError(t, err)

	res, err := client.Request(ctx, http.MethodPost, loginURL.String(), codersdk.LoginWithPasswordRequest{
		Email:    req.Email,
		Password: req.Password,
	})
	require.NoError(t, err)
	defer res.Body.Close()
	require.Equal(t, http.StatusCreated, res.StatusCode)

	oneYear := int((365 * 24 * time.Hour).Seconds())
	var found bool
	for _, cookie := range res.Cookies() {
		if cookie.Name == codersdk.SessionTokenCookie {
			// MaxAge should be set to a long value so the browser
			// persists the cookie to disk. The server handles real
			// expiry via the API key's ExpiresAt field.
			require.Equal(t, oneYear, cookie.MaxAge,
				"Session cookie MaxAge should be set to 1 year for disk persistence")
			found = true
		}
	}
	require.True(t, found, "session cookie should be present in login response")
}

func TestAPIKey_OK(t *testing.T) {
	t.Parallel()