sam/where_woof
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: shared session cookie domain (SESSION_COOKIE_DOMAIN) so apex + www stay logged in

Browse Source
This commit is contained in:
Sam Rolfe
2026-08-08 15:23:40 +10:00
parent 9349851bef
commit 426c99296d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
frontend/internal/auth/session.go
View File

@@ -2,6 +2,7 @@ package auth
import ( import (
"net/http" "net/http"
"os"
"github.com/gorilla/sessions" "github.com/gorilla/sessions"
) )
@@ -13,6 +14,8 @@ const SessionName = "ww_session"
var Store *sessions.CookieStore var Store *sessions.CookieStore
// InitSessionStore creates the cookie store with the server secret. // InitSessionStore creates the cookie store with the server secret.
// SESSION_COOKIE_DOMAIN (optional) shares the session across subdomains,
// e.g. ".where-woof.com" so apex + www both see the login.
func InitSessionStore(secret string) { func InitSessionStore(secret string) {
Store = sessions.NewCookieStore([]byte(secret)) Store = sessions.NewCookieStore([]byte(secret))
Store.Options = &sessions.Options{ Store.Options = &sessions.Options{
@@ -21,6 +24,9 @@ func InitSessionStore(secret string) {
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
MaxAge: 30 * 24 * 3600, // 30 days MaxAge: 30 * 24 * 3600, // 30 days
} }
if d := os.Getenv("SESSION_COOKIE_DOMAIN"); d != "" {
Store.Options.Domain = d
}
} }
// GetUserID returns the authenticated user id from the request, if any. // GetUserID returns the authenticated user id from the request, if any.