`f7c0e60`

csrf: thread cfg.Session.Secure into the cookie's Secure flag (SR2 H6)

Pre-fix: handlers.go:172 hardcoded CSRFConfig{Secure: false} with
comment 'S37 enables under TLS'. The session cookie correctly
honored cfg.Secure via server.go's session-store wiring; the CSRF
cookie did not. Caddy 301-redirects http→https in practice, but
the cookie was still settable/readable over plaintext if anyone
crafted an http:// link.

Post-fix:
- handlers.Deps gains CookieSecure: bool.
- server.go threads cfg.Session.Secure (already true on prod TLS
deployment per inventory). Tests and dev keep the false default.
- CSRFConfig.Secure now mirrors deps.CookieSecure.

Authored by

espadonne 3 days ago

SHA: f7c0e60f54cf334a469be097383f43675482f062
Parents: 6ea11a9
Tree: 6ca1307

2 changed files

Status	File	+	-
M	`internal/web/handlers/handlers.go`	9	1
M	`internal/web/server.go`	1	0

internal/web/handlers/handlers.gomodified

  	StaticFS     fs.FS
  	LogoSVG      string
  	SessionStore session.Store
 +	// CookieSecure is the Secure flag for session-related cookies
 +	// (currently the CSRF cookie). Mirrors session.Config.Secure
 +	// from the loaded config so the CSRF cookie matches the
 +	// session cookie in TLS deployments. Defaults to false when
 +	// unset, which is correct for tests and dev (SR2 H6).
 +	CookieSecure bool
  	// ReadyCheck is optionally invoked by /readyz. Returning a non-nil
  	// error makes /readyz report 503. If nil, /readyz always reports ready.
  	ReadyCheck func(context.Context) error
+ 	}
  	csrf := middleware.CSRF(middleware.CSRFConfig{
 -		Secure: false, // S37 enables under TLS
 +		// SR2 H6: session-cookie Secure flag mirrors here so TLS
 +		// deployments don't accept the CSRF cookie over plaintext.
 +		Secure: deps.CookieSecure,
  		FailureHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  			rr.HTTPError(w, r, http.StatusForbidden, "csrf")
  		}),

internal/web/server.gomodified

  		StaticFS:     StaticFS(),
  		LogoSVG:      string(logoBytes),
  		SessionStore: sessionStore,
 +		CookieSecure: cfg.Session.Secure,
+ 	}
  	if pool != nil {
  		deps.ReadyCheck = func(ctx context.Context) error { return pool.Ping(ctx) }