chore: optionally prefix authentication related cookies (#22148)

When the deployment option is enabled auth cookies are prefixed with
`__HOST-`
([info](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie)).

This is all done in a middleware that intercepts all requests and strips
the prefix on incoming request cookies.
This commit is contained in:
Steven Masley
2026-02-20 09:01:00 -06:00
committed by GitHub
parent 1069ce6e19
commit e5f64eb21d
15 changed files with 357 additions and 6 deletions
+1
View File
@@ -332,6 +332,7 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
sharedhttpmw.Recover(s.Logger),
httpmw.WithProfilingLabels,
tracing.StatusWriterMiddleware,
opts.CookieConfig.Middleware,
tracing.Middleware(s.TracerProvider),
httpmw.AttachRequestID,
httpmw.ExtractRealIP(s.Options.RealIPConfig),