Refactor

api/auth.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"log"
 	"net/http"
 	"time"
 
@@ -26,12 +27,17 @@ func handleLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	sessionID, _ := lib.CreateSession(user.ID)
+	sessionID, err := lib.CreateSession(user.ID)
+	if err != nil {
+		http.Error(w, "failed to create session", http.StatusInternalServerError)
+		return
+	}
 	http.SetCookie(w, &http.Cookie{
 		Name:     "session_token",
 		Value:    sessionID,
 		Expires:  time.Now().Add(24 * time.Hour),
 		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
 		Path:     "/",
 	})
 
@@ -68,13 +74,16 @@ func handleRegister(w http.ResponseWriter, r *http.Request) {
 func handleLogout(w http.ResponseWriter, r *http.Request) {
 	cookie, err := r.Cookie("session_token")
 	if err == nil {
-		lib.DeleteSession(cookie.Value)
+		if err := lib.DeleteSession(cookie.Value); err != nil {
+			log.Printf("delete session error: %v", err)
+		}
 	}
 	http.SetCookie(w, &http.Cookie{
-		Name:    "session_token",
-		Value:   "",
-		Expires: time.Now().Add(-1 * time.Hour),
-		Path:    "/",
+		Name:     "session_token",
+		Value:    "",
+		Expires:  time.Now().Add(-1 * time.Hour),
+		SameSite: http.SameSiteLaxMode,
+		Path:     "/",
 	})
 	http.Redirect(w, r, "/login", http.StatusSeeOther)
 }