small security fixes

Overlord-Server/src/server/routes/auth-cookie.test.ts

@@ -0,0 +1,57 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { shouldUseSecureAuthCookie } from "./auth-cookie";
+
+const ORIGINAL_ENV = {
+  OVERLORD_AUTH_COOKIE_SECURE: process.env.OVERLORD_AUTH_COOKIE_SECURE,
+  OVERLORD_TLS_OFFLOAD: process.env.OVERLORD_TLS_OFFLOAD,
+  OVERLORD_TRUST_PROXY_HEADERS: process.env.OVERLORD_TRUST_PROXY_HEADERS,
+};
+
+afterEach(() => {
+  for (const [key, value] of Object.entries(ORIGINAL_ENV)) {
+    if (value === undefined) delete (process.env as any)[key];
+    else (process.env as any)[key] = value;
+  }
+});
+
+describe("shouldUseSecureAuthCookie", () => {
+  test("does not trust X-Forwarded-Proto by default", () => {
+    delete process.env.OVERLORD_AUTH_COOKIE_SECURE;
+    delete process.env.OVERLORD_TLS_OFFLOAD;
+    delete process.env.OVERLORD_TRUST_PROXY_HEADERS;
+
+    const req = new Request("http://localhost/api/login", {
+      headers: { "x-forwarded-proto": "https" },
+    });
+
+    expect(shouldUseSecureAuthCookie(req)).toBe(false);
+  });
+
+  test("treats TLS offload as externally secure without forwarded headers", () => {
+    process.env.OVERLORD_TLS_OFFLOAD = "true";
+    delete process.env.OVERLORD_TRUST_PROXY_HEADERS;
+    delete process.env.OVERLORD_AUTH_COOKIE_SECURE;
+
+    const req = new Request("http://localhost/api/login");
+
+    expect(shouldUseSecureAuthCookie(req)).toBe(true);
+  });
+
+  test("trusts X-Forwarded-Proto when proxy headers are explicitly trusted", () => {
+    process.env.OVERLORD_TRUST_PROXY_HEADERS = "true";
+    delete process.env.OVERLORD_TLS_OFFLOAD;
+    delete process.env.OVERLORD_AUTH_COOKIE_SECURE;
+
+    const req = new Request("http://localhost/api/login", {
+      headers: { "x-forwarded-proto": "https" },
+    });
+
+    expect(shouldUseSecureAuthCookie(req)).toBe(true);
+  });
+
+  test("honors explicit secure override", () => {
+    process.env.OVERLORD_AUTH_COOKIE_SECURE = "true";
+    const req = new Request("http://localhost/api/login");
+    expect(shouldUseSecureAuthCookie(req)).toBe(true);
+  });
+});