pr comments

f0ssel · f0ssel · commit fccf4bba440e · 2022-03-31T15:15:10.000Z
diff --git a/coderd/httpmw/stricttransportsecurity.go b/coderd/httpmw/stricttransportsecurity.go
@@ -6,11 +6,6 @@ import (
 	"time"
 )
 
-const (
-	strictTransportSecurityHeader = "Strict-Transport-Security"
-	strictTransportSecurityMaxAge = time.Hour * 24 * 365 // 1 year
-)
-
 // StrictTransportSecurity will add the strict-transport-security header if enabled.
 // This header forces a browser to always use https for the domain after it loads https
 // once.
@@ -23,12 +18,13 @@ const (
 // nolint:revive
 func StrictTransportSecurity(enable bool) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			if enable {
-				w.Header().Set(strictTransportSecurityHeader, fmt.Sprintf("max-age=%d", int64(strictTransportSecurityMaxAge.Seconds())))
+				age := time.Hour * 24 * 365 // 1 year
+				rw.Header().Set("Strict-Transport-Security", fmt.Sprintf("max-age=%d", int64(age.Seconds())))
 			}
 
-			next.ServeHTTP(w, r)
+			next.ServeHTTP(rw, r)
 		})
 	}
 }
diff --git a/coderd/httpmw/stricttransportsecurity_test.go b/coderd/httpmw/stricttransportsecurity_test.go
@@ -13,14 +13,12 @@ import (
 	"github.com/coder/coder/coderd/httpmw"
 )
 
-const (
-	strictTransportSecurityHeader = "Strict-Transport-Security"
-	strictTransportSecurityMaxAge = time.Hour * 24 * 365
-)
-
 func TestStrictTransportSecurity(t *testing.T) {
 	t.Parallel()
 
+	strictTransportSecurityHeader := "Strict-Transport-Security"
+	strictTransportSecurityMaxAge := time.Hour * 24 * 365
+
 	setup := func(enable bool) *http.Response {
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/", nil)
diff --git a/coderd/users.go b/coderd/users.go
@@ -417,7 +417,7 @@ func (api *api) postLogin(rw http.ResponseWriter, r *http.Request) {
 		Path:     "/",
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
-		Secure:   api.SecureCookie,
+		Secure:   api.SecureAuthCookie,
 	})
 
 	render.Status(r, http.StatusCreated)
