set cookie domain when clearing request tracker cookie

crewjam · Dec 14, 2020 · acec889 · acec889
1 parent 6013850
commit acec889
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/samlsp/middleware_test.go b/samlsp/middleware_test.go
@@ -501,7 +501,7 @@ func TestMiddlewareCanParseResponse(t *testing.T) {
 
 	assert.Equal(t, "/frob", resp.Header().Get("Location"))
 	assert.Equal(t, []string{
-		"saml_KCosLjAyNDY4Ojw-QEJERkhKTE5QUlRWWFpcXmBiZGZoamxucHJ0dnh6=; Expires=Thu, 01 Jan 1970 00:00:01 GMT",
+		"saml_KCosLjAyNDY4Ojw-QEJERkhKTE5QUlRWWFpcXmBiZGZoamxucHJ0dnh6=; Domain=15661444.ngrok.io; Expires=Thu, 01 Jan 1970 00:00:01 GMT",
 		"ttt=" + test.expectedSessionCookie + "; " +
 			"Path=/; Domain=15661444.ngrok.io; Max-Age=7200; HttpOnly; Secure"},
 		resp.Header()["Set-Cookie"])

diff --git a/samlsp/request_tracker_cookie.go b/samlsp/request_tracker_cookie.go
@@ -56,6 +56,7 @@ func (t CookieRequestTracker) StopTrackingRequest(w http.ResponseWriter, r *http
 		return err
 	}
 	cookie.Value = ""
+	cookie.Domain = t.ServiceProvider.AcsURL.Host
 	cookie.Expires = time.Unix(1, 0) // past time as close to epoch as possible, but not zero time.Time{}
 	http.SetCookie(w, cookie)
 	return nil