coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Preserve browser Origin on the confirmed sign-out form
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 35s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 10:43:32 +02:00
parent 074c2ce498
commit 91efb6d988
2 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/internal/server/oidc/account_test.go
View file

@ -31,6 +31,9 @@ func TestSharedLogoutRequiresConfirmationAndFixedReturn(t *testing.T) {
if w.Code != 200 || w.Header().Get("Location") != "" {
t.Fatal("GET must only confirm")
}
if w.Header().Get("Referrer-Policy") != "same-origin" {
t.Fatal("browser POST would lose its Origin")
}
c := w.Result().Cookies()[0]
if !c.Secure || !c.HttpOnly || c.Domain != "" {
t.Fatal("unsafe CSRF cookie")