Function TestBuildSessionCookies

internal/cookie/cookie_test.go:13–46

(t *testing.T)

)

func TestBuildSessionCookies(t *testing.T) {
	tests := []struct {
		name       string
		hostname   string
		secure     bool
		sameSite   http.SameSite
		wantDomain string // expected `.example.com`-style domain on the domain-scoped cookie
	}{
		{"production https", "https://auth.example.com", true, http.SameSiteNoneMode, ".example.com"},
		{"localhost dev", "http://localhost:8080", false, http.SameSiteLaxMode, "localhost"},
		{"subdomain", "https://auth.svc.example.com", true, http.SameSiteStrictMode, ".example.com"},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cookies := BuildSessionCookies(tt.hostname, "session-id", tt.secure, tt.sameSite)
			require.Len(t, cookies, 2, "BuildSessionCookies must return exactly the host-scoped and domain-scoped pair")

			for _, c := range cookies {
				assert.Equal(t, "session-id", c.Value)
				assert.Equal(t, tt.secure, c.Secure)
				assert.True(t, c.HttpOnly, "session cookies must be HttpOnly")
				assert.Equal(t, "/", c.Path)
				assert.Equal(t, tt.sameSite, c.SameSite)
				assert.Equal(t, 24*60*60, c.MaxAge, "session cookie MaxAge must be 1 day")
			}

			// Sanity-check cookie names.
			assert.Equal(t, constants.AppCookieName+"_session", cookies[0].Name)
			assert.Equal(t, constants.AppCookieName+"_session_domain", cookies[1].Name)
			// Domain-scoped cookie picks up the apex.
			assert.Equal(t, tt.wantDomain, cookies[1].Domain)
		})
	}
}

func TestBuildMfaSessionCookies(t *testing.T) {
	cookies := BuildMfaSessionCookies("https://auth.example.com", "mfa-id", true)