Merge pull request #236 from P4sca1/cookies-after-api-authentication

use cookie helpers in HandleApiAuthentication to correctly set HttpOnly and Secure

Author: frikky

shared.go

@@ -3313,25 +3313,12 @@ func HandleApiAuthentication(resp http.ResponseWriter, request *http.Request) (U
 	if err == nil {
 		sessionToken := c.Value
 
-		newCookie := &http.Cookie{
-			Name:    "session_token",
-			Value:   sessionToken,
-			Expires: time.Now().Add(-100 * time.Hour),
-			MaxAge:  -1,
-			Path:    "/",
-		}
-
-		if project.Environment == "cloud" {
-			newCookie.Domain = ".shuffler.io"
-			newCookie.Secure = true
-			newCookie.HttpOnly = true
-		}
-
 		user, err := GetSessionNew(ctx, sessionToken)
 		if err != nil {
 			log.Printf("[WARNING] No valid session token for ID %s. Setting cookie to expire. May cause fallback problems.", sessionToken)
 
 			if resp != nil {
+				newCookie := constructSessionDeleteCookie()
 				http.SetCookie(resp, newCookie)
 
 				newCookie.Name = "__session"
@@ -3342,8 +3329,8 @@ func HandleApiAuthentication(resp http.ResponseWriter, request *http.Request) (U
 		} else {
 			// Check if both session tokens are set
 			// Compatibility issues
-			//expiration := time.Now().Add(8 * time.Hour
-			newCookie.Expires = c.Expires
+			//expiration := time.Now().Add(8 * time.Hour)
+			newCookie := ConstructSessionCookie(sessionToken, c.Expires)
 			newCookie.MaxAge = c.MaxAge
 
 			_, err1 := request.Cookie("session_token")
@@ -3366,22 +3353,8 @@ func HandleApiAuthentication(resp http.ResponseWriter, request *http.Request) (U
 		}
 
 		if len(user.Id) == 0 && len(user.Username) == 0 {
-
-			newCookie := &http.Cookie{
-				Name:    "session_token",
-				Value:   sessionToken,
-				Expires: time.Now().Add(-100 * time.Hour),
-				MaxAge:  -1,
-				Path:    "/",
-			}
-
-			if project.Environment == "cloud" {
-				newCookie.Domain = ".shuffler.io"
-				newCookie.Secure = true
-				newCookie.HttpOnly = true
-			}
-
 			if resp != nil {
+				newCookie := constructSessionDeleteCookie()
 				http.SetCookie(resp, newCookie)
 
 				newCookie.Name = "__session"