1 files changed, 18 insertions, 9 deletions
diff --git a/internal/auth/cookie.go b/internal/auth/cookie.go
index 9fd6b6e..8fa394d 100644
--- a/internal/auth/cookie.go
+++ b/internal/auth/cookie.go
@@ -7,17 +7,26 @@ import (
 
 const CookieName = "session"
 
-func SetSessionCookie(w http.ResponseWriter, token string) {
-	http.SetCookie(w, &http.Cookie{
+// SetSessionCookie sets the session cookie; secure marks it for https only,
+// which the app cannot tell on its own behind a plain-http proxy.
+func SetSessionCookie(w http.ResponseWriter, token string, secure bool) {
+	http.SetCookie(w, sessionCookie(token, int(SessionTTL/time.Second), secure))
+}
+
+// ClearSessionCookie expires the cookie with the same attributes it was set
+// with; browsers only replace a cookie whose Secure flag matches.
+func ClearSessionCookie(w http.ResponseWriter, secure bool) {
+	http.SetCookie(w, sessionCookie("", -1, secure))
+}
+
+func sessionCookie(value string, maxAge int, secure bool) *http.Cookie {
+	return &http.Cookie{
 		Name:     CookieName,
-		Value:    token,
+		Value:    value,
 		Path:     "/",
 		HttpOnly: true,
+		Secure:   secure,
 		SameSite: http.SameSiteLaxMode,
-		MaxAge:   int(SessionTTL / time.Second),
-	})
-}
-
-func ClearSessionCookie(w http.ResponseWriter) {
-	http.SetCookie(w, &http.Cookie{Name: CookieName, Value: "", Path: "/", HttpOnly: true, MaxAge: -1})
+		MaxAge:   maxAge,
+	}
 }