chore(auth): #331 add first session test

handler/middleware/authenticate.go

@@ -21,15 +21,23 @@ func Authenticate(service service.Auth) func(http.Handler) http.Handler {
 			sessionId := getSessionID(r)
 			session, user, _ := service.SignInSession(sessionId)
 
-			if session != nil {
+			// Always sign in anonymous
+			// This way, we can always generate csrf tokens
+			if session == nil {
+				session, err := service.SignInAnonymous()
+				if err != nil {
+					http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+					return
+				}
 
-				ctx = context.WithValue(ctx, UserKey, user)
-				ctx = context.WithValue(ctx, SessionKey, session)
-
-				next.ServeHTTP(w, r.WithContext(ctx))
-			} else {
-				next.ServeHTTP(w, r)
+				cookie := CreateSessionCookie(session.Id)
+				http.SetCookie(w, &cookie)
 			}
+
+			ctx = context.WithValue(ctx, UserKey, user)
+			ctx = context.WithValue(ctx, SessionKey, session)
+
+			next.ServeHTTP(w, r.WithContext(ctx))
 		})
 	}
 }

handler/middleware/cross_site_request_forgery.go

@@ -62,15 +62,6 @@ func CrossSiteRequestForgery(auth service.Auth) func(http.Handler) http.Handler
 				}
 			}
 
-			// Always sign in anonymous
-			// This way, there is no way to forget creating a csrf token
-			if session == nil {
-				session, _ = auth.SignInAnonymous()
-
-				cookie := CreateSessionCookie(session.Id)
-				http.SetCookie(w, &cookie)
-			}
-
 			responseWriter := newCsrfResponseWriter(w, auth, session)
 			next.ServeHTTP(responseWriter, r)
 		})

handler/middleware/security_headers.go

@@ -22,7 +22,7 @@ func SecurityHeaders(serverSettings *types.Settings) func(http.Handler) http.Han
 					"form-action 'self'; "+
 					"frame-ancestors 'none'; ",
 			)
-			w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
+			w.Header().Set("Cross-Origin-Resource-Policy", "same-site") // same-site, as same origin prohibits umami
 			w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
 			w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp")
 			w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()")