auth: shared session cookie domain (SESSION_COOKIE_DOMAIN) so apex + www stay logged in

frontend/internal/auth/session.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"net/http"
+	"os"
 
 	"github.com/gorilla/sessions"
 )
@@ -13,6 +14,8 @@ const SessionName = "ww_session"
 var Store *sessions.CookieStore
 
 // InitSessionStore creates the cookie store with the server secret.
+// SESSION_COOKIE_DOMAIN (optional) shares the session across subdomains,
+// e.g. ".where-woof.com" so apex + www both see the login.
 func InitSessionStore(secret string) {
 	Store = sessions.NewCookieStore([]byte(secret))
 	Store.Options = &sessions.Options{
@@ -21,6 +24,9 @@ func InitSessionStore(secret string) {
 		SameSite: http.SameSiteLaxMode,
 		MaxAge:   30 * 24 * 3600, // 30 days
 	}
+	if d := os.Getenv("SESSION_COOKIE_DOMAIN"); d != "" {
+		Store.Options.Domain = d
+	}
 }
 
 // GetUserID returns the authenticated user id from the request, if any.