From da9bab512519fbf97bb0e973f51557592f1dce29 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 15:05:13 -1000
Subject: Check a session cookie scoped below the root

A cookie_path other than / has to keep Secure but drop the __Host-
name, which a browser takes only for the whole host. Neither was
tried.
---
 tests/extensions/test-auth.lua | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'tests/extensions/test-auth.lua')

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 822a075..d91287a 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -658,6 +658,15 @@ h.contains("so its form is shown over plain http", out, "<form class='login'")
 h.excludes("without asking for https", out, "only works over https")
 load_script()
 
+-- A browser takes a __Host- cookie only for the whole host, so one scoped
+-- below the root keeps the plain name, though it stays Secure.
+load_script({ { "local cookie_path = \"/\"", "local cookie_path = \"/cgit/\"" } })
+out = login("Alice", password, way_back)
+h.check("a cookie scoped below the root keeps its plain name and stays Secure",
+	out:find("\nSet%-Cookie: cgitauth=[^;]+; HttpOnly; SameSite=Lax; Path=/cgit/; Secure; Max%-Age=604800\n") ~= nil, out)
+h.excludes("rather than the __Host- one", out, "__Host-")
+load_script()
+
 -- A cookie carries whole seconds, while on Lua 5.3 and later a session length
 -- worked out with a fraction is a float, which tostring writes with a ".0".
 load_script({ { "local session_seconds = 7 * 24 * 60 * 60",
-- 
cgit 2.12.1