| 1367 | } |
| 1368 | |
| 1369 | func TestHTTPCookieConfigMiddleware(t *testing.T) { |
| 1370 | t.Parallel() |
| 1371 | |
| 1372 | // Realistic cookies that are always present in production. |
| 1373 | // These cookies are added to every test. |
| 1374 | baseCookies := []*http.Cookie{ |
| 1375 | {Name: "_ga", Value: "GA1.1.661026807.1770083336"}, |
| 1376 | {Name: "_ga_G0Q1B9GRC0", Value: "GS2.1.s1771343727$o49$g1$t1771343993$j48$l0$h0"}, |
| 1377 | {Name: "csrf_token", Value: "gDiKk8GjTM2iCUHAPfN9GlC+DGjzAprlLi2vJ+5TBU0="}, |
| 1378 | } |
| 1379 | |
| 1380 | cases := []struct { |
| 1381 | name string |
| 1382 | cfg codersdk.HTTPCookieConfig |
| 1383 | extraCookies []*http.Cookie |
| 1384 | expectedCookies map[string]string // cookie name -> value that handler should see |
| 1385 | expectedDeleted []string // if any cookies are supposed to be deleted via Set-Cookie |
| 1386 | }{ |
| 1387 | { |
| 1388 | name: "Disabled_PassesThrough", |
| 1389 | cfg: codersdk.HTTPCookieConfig{}, |
| 1390 | extraCookies: []*http.Cookie{ |
| 1391 | {Name: codersdk.SessionTokenCookie, Value: "token123"}, |
| 1392 | }, |
| 1393 | expectedCookies: map[string]string{ |
| 1394 | codersdk.SessionTokenCookie: "token123", |
| 1395 | }, |
| 1396 | }, |
| 1397 | { |
| 1398 | name: "Enabled_StripsPrefixFromCookie", |
| 1399 | cfg: codersdk.HTTPCookieConfig{EnableHostPrefix: true}, |
| 1400 | extraCookies: []*http.Cookie{ |
| 1401 | {Name: "__Host-" + codersdk.SessionTokenCookie, Value: "token123"}, |
| 1402 | }, |
| 1403 | expectedCookies: map[string]string{ |
| 1404 | codersdk.SessionTokenCookie: "token123", |
| 1405 | }, |
| 1406 | }, |
| 1407 | { |
| 1408 | name: "Enabled_DeletesUnprefixedCookie", |
| 1409 | cfg: codersdk.HTTPCookieConfig{EnableHostPrefix: true}, |
| 1410 | extraCookies: []*http.Cookie{ |
| 1411 | // Unprefixed cookie that should be in the "to prefix" list. |
| 1412 | {Name: codersdk.SessionTokenCookie, Value: "unprefixed-token"}, |
| 1413 | }, |
| 1414 | expectedCookies: map[string]string{ |
| 1415 | // Session token should NOT be present - it was deleted. |
| 1416 | }, |
| 1417 | expectedDeleted: []string{codersdk.SessionTokenCookie}, |
| 1418 | }, |
| 1419 | { |
| 1420 | name: "Enabled_BothPrefixedAndUnprefixed", |
| 1421 | cfg: codersdk.HTTPCookieConfig{EnableHostPrefix: true}, |
| 1422 | extraCookies: []*http.Cookie{ |
| 1423 | // Browser might send both during migration. |
| 1424 | {Name: codersdk.SessionTokenCookie, Value: "unprefixed-token"}, |
| 1425 | {Name: "__Host-" + codersdk.SessionTokenCookie, Value: "prefixed-token"}, |
| 1426 | }, |