Skip to content

WIP: Set cookies server-side

Michael Bryant requested to merge (removed):securecookies into master

First hurdle to being able to close #79.

This merge request removes all code for setting, manipulating, or reading cookies on the frontend and adds code to do the same in the server. All JSON requests were modified to no longer contain the token and, in cases where the token was the only item in the JSON, the JSON was replaced with null.

Added a couple helper functions for getting/setting cookies on requests, which will be extended in a later commit to use github.com/gorilla/securecookie.

The owner logout page was completely removed, in favor of a handler that deletes the cookies and automatically redirects the client back to the login page.

I've done my best to manually test that everything works. I was able to log in and out of the admin dashboard as well as a comment thread. Up/down voting, deleting and replying to comments works. Locking threads works. The only things I wasn't able to test were Google OAuth and Disqus importing, though I did my best to make those support cookies too.

I will update this merge request to include securecookie, but I wanted to get eyes on these major changes ASAP to make sure there are no regressions.

Merge request reports