From 6e22012d152974a3c2648726ce5c2fb3e6d5201f Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Sat, 15 Nov 2025 09:51:55 -0800
Subject: Fix cookie names and domain

---
 roseh.moe.go | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/roseh.moe.go b/roseh.moe.go
index cfcd0d9..2092f5c 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -32,6 +32,7 @@ import (
 var (
 	port        = flag.Int("port", 42069, "port to listen on")
 	selfURL     = flag.String("self-url", "http://localhost:42069", "base URL of the server")
+	domain      = flag.String("domain", "", "domain for auth cookie")
 	secretsFile = flag.String("secrets", "secrets.ccl", "secrets file")
 	configFile  = flag.String("config", "config.ccl", "configuration file (ccl format https://pkg.go.dev/roseh.moe/pkg/ccl)")
 	https       = flag.String("https", "", "directory containing cert.pem and key.pem, or empty string to use unencrypted http")
@@ -353,7 +354,8 @@ func makeToken() (string, error) {
 	return base64.RawURLEncoding.EncodeToString(sign(b)), nil
 }
 
-const cookieExpiration = 180 * 24 * time.Hour
+const cookieExpiration = 7 * 24 * time.Hour
+const authCookieName = "roseh.moe.auth"
 
 func attachCookie(w http.ResponseWriter) error {
 	token, err := makeToken()
@@ -361,9 +363,10 @@ func attachCookie(w http.ResponseWriter) error {
 		return err
 	}
 	http.SetCookie(w, &http.Cookie{
-		Name:        "auth",
+		Name:        authCookieName,
 		Value:       token,
 		Path:        "/",
+		Domain:      *domain,
 		Expires:     time.Now().Add(cookieExpiration),
 		Secure:      true,
 		HttpOnly:    true,
@@ -374,7 +377,7 @@ func attachCookie(w http.ResponseWriter) error {
 }
 
 func cookieAuth(w http.ResponseWriter, r *http.Request) bool {
-	cookie, err := r.Cookie("auth")
+	cookie, err := r.Cookie(authCookieName)
 	if err != nil {
 		return false
 	}
@@ -400,16 +403,18 @@ func cookieAuth(w http.ResponseWriter, r *http.Request) bool {
 	return true
 }
 
+const csrfCookieName = "roseh.moe.csrf-token"
+
 func reqCSRFToken(w http.ResponseWriter, r *http.Request) string {
 	const csrfTokenLen = 32
-	if csrfCookie, err := r.Cookie("csrf-token"); err == nil {
+	if csrfCookie, err := r.Cookie(csrfCookieName); err == nil {
 		return csrfCookie.Value
 	} else {
 		buf := make([]byte, csrfTokenLen)
 		rand.Read(buf)
 		csrfToken := base64.RawURLEncoding.EncodeToString(buf)
 		http.SetCookie(w, &http.Cookie{
-			Name:        "csrf-token",
+			Name:        csrfCookieName,
 			Value:       csrfToken,
 			Path:        "/",
 			Secure:      true,
@@ -422,7 +427,7 @@ func reqCSRFToken(w http.ResponseWriter, r *http.Request) string {
 }
 
 func checkCSRFToken(r *http.Request) error {
-	cookie, err := r.Cookie("csrf-token")
+	cookie, err := r.Cookie(csrfCookieName)
 	if err != nil {
 		return err
 	}
-- 
cgit v1.3.1