fix(auth): namespace Goto cookies #17

Merged

eleith merged 1 commits from feat/auth-cookie-prefix into main 2026-11-10 18:41:29 +00:00

Conversation 0 Commits 1 Files Changed 3

+80

eleith-gitea-agent Bot commented 2026-11-10 18:31:53 +00:00

Copy link

Copy source

Summary

Set Better Auth's native advanced.cookiePrefix to goto, preventing Goto from overwriting other apps' default authentication cookies when they share localhost.

• HTTP cookie names use goto.*; HTTPS retains native __Secure-goto.* naming.
• Sign-in, session reads, sign-out and OAuth state use the native configured namespace.
• Existing cookie security attributes, session lifetime, CSRF/origin checks, providers and browser-client configuration are unchanged.
• Existing Goto sessions require a fresh sign-in. Default/shared cookies are deliberately not deleted or migrated because they may belong to another app.
• No new dependency, configuration knob, schema, cookie-name map or cleanup mechanism.

One commit, three files: one application setting, two focused in-process HTTP/HTTPS-configured auth cases, and fixed app-group patch metadata. The tests exercise the actual factory/handler and public cookie-parser pattern used by When; the app-specific prefix is an owner-selected adaptation, not an existing reference-app setting.

Verification

All four independent reviews are clean: readability, correctness/security, test quality and explicit reference parity.

pnpm verify passed:

• Schema, workspace builds, TypeScript, Prettier and ESLint.
• Svelte: 0 errors, 0 warnings.
• 528 workspace unit tests, including both new cookie-ownership cases.
• 6 script tests, 8 Chromium production-build E2E tests, 5 worker service process cases.

Changeset status and whitespace checks passed. All three committed blobs match the exact final reviewed/passing source hashes.

The new cases verify issued/logout cookie names and working session reads with foreign default cookies present. They use in-process Requests, not actual TLS sockets or a second app/browser cookie jar. Native deletion attributes and OAuth handling were source-reviewed, not duplicated into a library test matrix. Docker was not agent-run. Remote CI must pass before merge.

## Summary Set Better Auth's native `advanced.cookiePrefix` to `goto`, preventing Goto from overwriting other apps' default authentication cookies when they share localhost. - HTTP cookie names use `goto.*`; HTTPS retains native `__Secure-goto.*` naming. - Sign-in, session reads, sign-out and OAuth state use the native configured namespace. - Existing cookie security attributes, session lifetime, CSRF/origin checks, providers and browser-client configuration are unchanged. - Existing Goto sessions require a fresh sign-in. Default/shared cookies are deliberately not deleted or migrated because they may belong to another app. - No new dependency, configuration knob, schema, cookie-name map or cleanup mechanism. One commit, three files: one application setting, two focused in-process HTTP/HTTPS-configured auth cases, and fixed app-group patch metadata. The tests exercise the actual factory/handler and public cookie-parser pattern used by When; the app-specific prefix is an owner-selected adaptation, not an existing reference-app setting. ## Verification All four independent reviews are clean: readability, correctness/security, test quality and explicit reference parity. `pnpm verify` passed: - Schema, workspace builds, TypeScript, Prettier and ESLint. - Svelte: **0 errors, 0 warnings**. - **528 workspace unit tests**, including both new cookie-ownership cases. - **6 script tests**, **8 Chromium production-build E2E tests**, **5 worker service process cases**. Changeset status and whitespace checks passed. All three committed blobs match the exact final reviewed/passing source hashes. The new cases verify issued/logout cookie names and working session reads with foreign default cookies present. They use in-process Requests, not actual TLS sockets or a second app/browser cookie jar. Native deletion attributes and OAuth handling were source-reviewed, not duplicated into a library test matrix. Docker was not agent-run. Remote CI must pass before merge.

eleith-gitea-agent Bot added 1 commit 2026-11-10 18:31:53 +00:00

fix(auth): namespace Goto cookies e7d8fc07e4

eleith merged commit e7d8fc07e4 into main 2026-11-10 18:41:29 +00:00

eleith deleted branch feat/auth-cookie-prefix 2026-11-10 18:41:29 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

eleith-gitea-agent Bot eleith (eleith)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/goto#17