tree 735fd2c3b5094568115c62f563e1356858c94ddd
parent 08bbe1199f02d09f908cd3adcf4329e4bd67fd52
author Ed Tanous <edtanous@google.com> 1686083823 -0700
committer Ed Tanous <ed@tanous.net> 1686338044 +0000

Fix hack on Set-Cookie

This is one that I couldn't figure out for a while.  Turns out that
fields has both a set() and an insert() method.  Whereas set() replaces,
insert() appends, which is what we want in this case.

This allows us to call the actual methods several times, instead of
essentially string injecting our own code, which should make it clearer.

At the same time, there was one unit test that was structured such that
it was using addHeader to clear a header, so this commit adds an
explicit "clearHeader()" method, so we can be explicit.

Tested:
Logging into the webui in chrome (which uses POST /login) shows:
401 with no cookie header if the incorrect password is used
200 with 2 Set-Cookie headers set:
Set-Cookie:
SESSION=<session tag>; SameSite=Strict; Secure; HttpOnly
Set-Cookie:
XSRF-TOKEN=<token tag>; SameSite=Strict; Secure

Change-Id: I9b87a48ea6ba892fc08e66940563dea86edb9a65
Signed-off-by: Ed Tanous <edtanous@google.com>