2 files changed, 20 insertions, 4 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 2ef2328..f5d250c 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -101,6 +101,14 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+-- A browser accepts a cookie named __Host- only when it is Secure, covers the
+-- whole host and was set by this host, so no sibling subdomain can plant a
+-- session in its place. Either cookie setting above can rule that out.
+local session_cookie = cookie_name
+if not cookie_insecure and cookie_path == "/" then
+	session_cookie = "__Host-" .. cookie_name
+end
+
 -- One request reaches this script as an open, a write and a close, so what the
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
@@ -502,7 +510,7 @@ function authenticate_post()
 	end
 
 	-- A failed login answers with an empty session, which clears the cookie.
-	set_cookie(cookie_name, session)
+	set_cookie(session_cookie, session)
 
 	html("\n")
 	return 0
@@ -517,7 +525,7 @@ function authenticate_cookie()
 		return 1
 	end
 
-	local cookie = get_cookie(http["cookie"], cookie_name)
+	local cookie = get_cookie(http["cookie"], session_cookie)
 	local username = validate_value("username", cookie, account_hash)
 	if username == nil or not accepted_users[username:lower()] then
 		return 0
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index bce2472..ae21c7a 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -100,6 +100,14 @@ local cookie_insecure = false
 -- the password's length, and one longer than this is turned down unchecked.
 local max_password_bytes = 256
 
+-- A browser accepts a cookie named __Host- only when it is Secure, covers the
+-- whole host and was set by this host, so no sibling subdomain can plant a
+-- session in its place. Either cookie setting above can rule that out.
+local session_cookie = cookie_name
+if not cookie_insecure and cookie_path == "/" then
+	session_cookie = "__Host-" .. cookie_name
+end
+
 -- One request reaches this script as an open, a write and a close, so what the
 -- open decodes is kept here for the calls that follow.
 local action, http, cgit, post
@@ -463,7 +471,7 @@ function authenticate_post()
 	end
 
 	-- A failed login answers with an empty session, which clears the cookie.
-	set_cookie(cookie_name, session)
+	set_cookie(session_cookie, session)
 
 	html("\n")
 	return 0
@@ -478,7 +486,7 @@ function authenticate_cookie()
 		return 1
 	end
 
-	local cookie = get_cookie(http["cookie"], cookie_name)
+	local cookie = get_cookie(http["cookie"], session_cookie)
 	local username = validate_value("username", cookie, account_hash)
 	if username == nil or not accepted_users[username:lower()] then
 		return 0