Check a session cookie scoped below the root

A cookie_path other than / has to keep Secure but drop the __Host-
name, which a browser takes only for the whole host. Neither was
tried.

1 file changed, 9 insertions, 0 deletions

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex 822a075..d91287a 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -658,6 +658,15 @@ h.contains("so its form is shown over plain http", out, "<form class='login'") h.excludes("without asking for https", out, "only works over https") load_script() +-- A browser takes a __Host- cookie only for the whole host, so one scoped+-- below the root keeps the plain name, though it stays Secure.+load_script({ { "local cookie_path = \"/\"", "local cookie_path = \"/cgit/\"" } })+out = login("Alice", password, way_back)+h.check("a cookie scoped below the root keeps its plain name and stays Secure",+	out:find("\nSet%-Cookie: cgitauth=[^;]+; HttpOnly; SameSite=Lax; Path=/cgit/; Secure; Max%-Age=604800\n") ~= nil, out)+h.excludes("rather than the __Host- one", out, "__Host-")+load_script()+ -- A cookie carries whole seconds, while on Lua 5.3 and later a session length -- worked out with a fraction is a float, which tostring writes with a ".0". load_script({ { "local session_seconds = 7 * 24 * 60 * 60",
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 822a075..d91287a 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -658,6 +658,15 @@ h.contains("so its form is shown over plain http", out, "<form class='login'")
 h.excludes("without asking for https", out, "only works over https")
 load_script()
 
+-- A browser takes a __Host- cookie only for the whole host, so one scoped
+-- below the root keeps the plain name, though it stays Secure.
+load_script({ { "local cookie_path = \"/\"", "local cookie_path = \"/cgit/\"" } })
+out = login("Alice", password, way_back)
+h.check("a cookie scoped below the root keeps its plain name and stays Secure",
+	out:find("\nSet%-Cookie: cgitauth=[^;]+; HttpOnly; SameSite=Lax; Path=/cgit/; Secure; Max%-Age=604800\n") ~= nil, out)
+h.excludes("rather than the __Host- one", out, "__Host-")
+load_script()
+
 -- A cookie carries whole seconds, while on Lua 5.3 and later a session length
 -- worked out with a fraction is a float, which tostring writes with a ".0".
 load_script({ { "local session_seconds = 7 * 24 * 60 * 60",