coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow registered provider redirects after sign-out confirmation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 10:47:33 +02:00
parent 91efb6d988
commit 4d8b8fe934
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/internal/server/oidc/account_test.go
View file

@ -34,6 +34,9 @@ func TestSharedLogoutRequiresConfirmationAndFixedReturn(t *testing.T) {
if w.Header().Get("Referrer-Policy") != "same-origin" {
t.Fatal("browser POST would lose its Origin")
}
if !strings.Contains(w.Header().Get("Content-Security-Policy"), "form-action 'self' https://auth.example https://users.example;") {
t.Fatal("browser must follow registered sign-out destinations")
}
c := w.Result().Cookies()[0]
if !c.Secure || !c.HttpOnly || c.Domain != "" {
t.Fatal("unsafe CSRF cookie")