3 files changed, 21 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 8a70887..282168a 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -113,6 +113,11 @@ if not cookie_insecure and cookie_path == "/" then
 	session_cookie = "__Host-" .. cookie_name
 end
 
+-- A cookie carries its expiry and Max-Age as whole seconds, while on Lua 5.3
+-- and later a length worked out with a fraction, such as 1.5 days, is a float
+-- that tostring would write with a trailing ".0".
+session_seconds = math.floor(session_seconds)
+
 -- One request reaches this script as an open, a write and a close, so what the
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 3530890..8b4e873 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -112,6 +112,11 @@ if not cookie_insecure and cookie_path == "/" then
 	session_cookie = "__Host-" .. cookie_name
 end
 
+-- A cookie carries its expiry and Max-Age as whole seconds, while on Lua 5.3
+-- and later a length worked out with a fraction, such as 1.5 days, is a float
+-- that tostring would write with a trailing ".0".
+session_seconds = math.floor(session_seconds)
+
 -- One request reaches this script as an open, a write and a close, so what the
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index a45b1e9..974544d 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -353,6 +353,17 @@ h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie:
 h.excludes("and is not marked Secure", out, "; Secure")
 load_script()
 
+-- A cookie carries whole seconds, while on Lua 5.3 and later a session length
+-- worked out with a fraction is a float, which tostring writes with a ".0".
+load_script({ { "local session_seconds = 7 * 24 * 60 * 60",
+	"local session_seconds = 1.5 * 24 * 60 * 60" } })
+out = login("Alice", password, way_back)
+granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);")
+h.equals("a session a day and a half long still verifies",
+	granted and validate_value("username", granted, account_hash), "Alice")
+h.contains("and its cookie lasts as many whole seconds", out, "; Max-Age=129600\n")
+load_script()
+
 -- The libraries load only once a request needs one, so with every one of
 -- them gone a public repository is still served, while a protected one
 -- fails closed instead of reaching its content.
-rw-r--r--	custom/extensions/auth-file.lua	5
-rw-r--r--	custom/extensions/auth-inline.lua	5
-rw-r--r--	tests/extensions/test-auth.lua	11