add debug prints

Author: paskal

v2/token/jwt.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log"
 	"net/http"
 	"slices"
 	"strings"
@@ -268,13 +269,31 @@ func (j *Service) Set(w http.ResponseWriter, claims Claims) (Claims, error) {
 	// This allows the OAuth flow to complete successfully
 	needsCookies := claims.Handshake != nil
 
+	if needsCookies {
+		log.Printf("[ERROR] OAuth handshake request from %s, will set cookie %s=%s",
+			claims.Handshake.From,
+			j.JWTCookieName,
+			tokenString[:10]+"...")
+	}
+
 	// Set the JWT in the header if requested,
 	// skip setting cookies unless this is part of OAuth handshake
 	if j.SendJWTHeader && !needsCookies {
+		log.Printf("[ERROR] Won't set cookie, will write claims to header instead: %v", claims)
 		w.Header().Set(j.JWTHeaderKey, tokenString)
+		// reset existing JWT cookies which we might have left after OAuth handshake
+		jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain,
+			MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite}
+		http.SetCookie(w, &jwtCookie)
+
+		xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain,
+			MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite}
+		http.SetCookie(w, &xsrfCookie)
 		return claims, nil
 	}
 
+	log.Printf("[ERROR] Cookie setting: %v", claims)
+
 	cookieExpiration := 0 // session cookie
 	if !claims.SessionOnly && claims.Handshake == nil {
 		cookieExpiration = int(j.CookieDuration.Seconds())
@@ -359,11 +378,11 @@ func (j *Service) IsExpired(claims Claims) bool {
 
 // Reset token's cookies
 func (j *Service) Reset(w http.ResponseWriter) {
-	jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain,
+	jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain,
 		MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite}
 	http.SetCookie(w, &jwtCookie)
 
-	xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain,
+	xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain,
 		MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite}
 	http.SetCookie(w, &xsrfCookie)