Claus Lohmar
d11e14295b
- store: SQLite (WAL, foreign keys ON, CGO-free driver) + the embedded migration runner; each module's migrations are name-prefixed (D-012) - audit: the append-only audit log; the actor threads via context (R-1) - users: the user_id/GUID/email anchors (D-013) - config: the YAML settings file (D-035) + validation - httpx: cookies · loopback detection · trusted-proxy XFF · CSRF · security headers · redaction - middleware: correlation id · audit · rate limiting - mail: the invite/recovery mailer seam - server: the core DOOR — the resolution switch, the dispatch registry (RegisterModule), the role gates, /setup · enroll/login · recovery flows, the reserved `static` workflow, and the loopback-only bootstrap (D-025)
40 lines
1.3 KiB
Go
40 lines
1.3 KiB
Go
// Package httpx holds the door's HTTP helpers: the session cookie, the client
|
|
// IP resolution (trusted proxies, A6), the security headers, log redaction, and
|
|
// the CSRF token (SPEC-003 §6/§8).
|
|
//
|
|
// It imports only net/http + the standard library — the door owns HTTP; the
|
|
// pure routing model (internal/core/routing) must never import this.
|
|
package httpx
|
|
|
|
import "net/http"
|
|
|
|
// SessionCookieName is the name of the session cookie (SPEC-003 §6). The value
|
|
// is an opaque random id; the server-side session row is authoritative.
|
|
const SessionCookieName = "myday_session"
|
|
|
|
// SetSessionCookie writes the hardened session cookie (SPEC-003 §6):
|
|
// HttpOnly · Secure · SameSite=Lax · Path=/. The lifetime is server-side, so
|
|
// no Max-Age is set (a browser-session cookie).
|
|
func SetSessionCookie(w http.ResponseWriter, name, value string, secure bool) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: name,
|
|
Value: value,
|
|
Path: "/",
|
|
HttpOnly: true,
|
|
Secure: secure,
|
|
SameSite: http.SameSiteLaxMode,
|
|
})
|
|
}
|
|
|
|
// ClearSessionCookie expires the session cookie (logout, or an invalid session).
|
|
func ClearSessionCookie(w http.ResponseWriter, name string, secure bool) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: name,
|
|
Value: "",
|
|
Path: "/",
|
|
HttpOnly: true,
|
|
Secure: secure,
|
|
SameSite: http.SameSiteLaxMode,
|
|
MaxAge: -1,
|
|
})
|
|
}
|