fix(server): secure cookies (#5682)

internal/server/server.go

@@ -232,12 +232,7 @@ func (s *Server) isAuthenticated(rc requestContext) bool {
 	if err != nil {
 		userLog(rc.req.Context()).Errorf("unable to generate short-term auth cookie: %v", err)
 	} else {
-		http.SetCookie(rc.w, &http.Cookie{ //nolint:gosec
-			Name:    kopiaAuthCookie,
-			Value:   ac,
-			Expires: now.Add(kopiaAuthCookieTTL),
-			Path:    "/",
-		})
+		http.SetCookie(rc.w, newCookie(rc.req.TLS != nil, kopiaAuthCookie, ac, now.Add(kopiaAuthCookieTTL)))
 
 		if s.options.LogRequests {
 			// Log successful authentication
@@ -248,6 +243,23 @@ func (s *Server) isAuthenticated(rc requestContext) bool {
 	return true
 }
 
+func newCookie(secure bool, name, value string, expires time.Time) *http.Cookie {
+	cookie := &http.Cookie{ //nolint:gosec
+		Name:     name,
+		Value:    value,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	}
+
+	if !expires.IsZero() {
+		cookie.Expires = expires
+	}
+
+	return cookie
+}
+
 func (s *Server) isAuthCookieValid(username, cookieValue string) bool {
 	tok, err := jwt.ParseWithClaims(cookieValue, &jwt.RegisteredClaims{}, func(_ *jwt.Token) (any, error) {
 		return s.authCookieSigningKey, nil
@@ -830,11 +842,7 @@ func (s *Server) ServeStaticFiles(m *mux.Router, fs http.FileSystem) {
 			} else {
 				sessionID = uuid.NewString()
 
-				http.SetCookie(w, &http.Cookie{ //nolint:gosec
-					Name:  kopiaSessionCookie,
-					Value: sessionID,
-					Path:  "/",
-				})
+				http.SetCookie(w, newCookie(r.TLS != nil, kopiaSessionCookie, sessionID, time.Time{}))
 			}
 
 			http.ServeContent(w, r, "/", clock.Now(), bytes.NewReader(s.patchIndexBytes(sessionID, indexBytes)))

internal/server/server_cookie_test.go

@@ -0,0 +1,28 @@
+package server
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewCookie(t *testing.T) {
+	expires := time.Date(2026, time.October, 3, 0, 0, 0, 0, time.UTC)
+
+	cookie := newCookie(false, "name", "value", expires)
+
+	require.Equal(t, "name", cookie.Name)
+	require.Equal(t, "value", cookie.Value)
+	require.Equal(t, "/", cookie.Path)
+	require.True(t, cookie.HttpOnly)
+	require.Equal(t, http.SameSiteStrictMode, cookie.SameSite)
+	require.False(t, cookie.Secure)
+	require.Equal(t, expires, cookie.Expires)
+
+	cookie = newCookie(true, "name", "value", time.Time{})
+
+	require.True(t, cookie.Secure)
+	require.True(t, cookie.Expires.IsZero())
+}