From 3d7c387548252cbefe50229edcd74a1f1602ec30 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:44:16 -0700 Subject: Write a session's expiry in whole seconds On Lua 5.3 and later a length worked out with a fraction, such as 1.5 * 24 * 60 * 60, is a float, so the signed expiry came out as 1793609024.0, which validate_value refuses, and every login failed. Max-Age took the same .0, which makes a browser ignore it. --- custom/extensions/auth-file.lua | 5 +++++ custom/extensions/auth-inline.lua | 5 +++++ tests/extensions/test-auth.lua | 11 +++++++++++ 3 files changed, 21 insertions(+) diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 8a70887..282168a 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -113,6 +113,11 @@ if not cookie_insecure and cookie_path == "/" then session_cookie = "__Host-" .. cookie_name end +-- A cookie carries its expiry and Max-Age as whole seconds, while on Lua 5.3 +-- and later a length worked out with a fraction, such as 1.5 days, is a float +-- that tostring would write with a trailing ".0". +session_seconds = math.floor(session_seconds) + -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 3530890..8b4e873 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -112,6 +112,11 @@ if not cookie_insecure and cookie_path == "/" then session_cookie = "__Host-" .. cookie_name end +-- A cookie carries its expiry and Max-Age as whole seconds, while on Lua 5.3 +-- and later a length worked out with a fraction, such as 1.5 days, is a float +-- that tostring would write with a trailing ".0". +session_seconds = math.floor(session_seconds) + -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index a45b1e9..974544d 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -353,6 +353,17 @@ h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie: h.excludes("and is not marked Secure", out, "; Secure") load_script() +-- A cookie carries whole seconds, while on Lua 5.3 and later a session length +-- worked out with a fraction is a float, which tostring writes with a ".0". +load_script({ { "local session_seconds = 7 * 24 * 60 * 60", + "local session_seconds = 1.5 * 24 * 60 * 60" } }) +out = login("Alice", password, way_back) +granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);") +h.equals("a session a day and a half long still verifies", + granted and validate_value("username", granted, account_hash), "Alice") +h.contains("and its cookie lasts as many whole seconds", out, "; Max-Age=129600\n") +load_script() + -- The libraries load only once a request needs one, so with every one of -- them gone a public repository is still served, while a protected one -- fails closed instead of reaching its content. -- cgit