security: blindaje contra ejecucion de scripts RCE, Stored XSS, MIME sniffing, Path Traversal y DoS

internal/auth/auth.go

@@ -59,6 +59,21 @@ func (a *AuthService) GenerateToken(length int) string {
 	return hex.EncodeToString(bytes)
 }
 
+func (a *AuthService) isSecureRequest(r *http.Request) bool {
+	if r.TLS != nil {
+		return true
+	}
+	if strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https") ||
+		strings.EqualFold(r.Header.Get("X-Forwarded-Ssl"), "on") ||
+		r.Header.Get("X-Forwarded-Port") == "443" {
+		return true
+	}
+	if strings.HasPrefix(a.cfg.BaseURL, "https://") {
+		return true
+	}
+	return false
+}
+
 func (a *AuthService) GetOrCreateSession(w http.ResponseWriter, r *http.Request) *models.Session {
 	cookie, err := r.Cookie(CookieSessionName)
 	if err == nil && cookie.Value != "" {
@@ -93,6 +108,7 @@ func (a *AuthService) GetOrCreateSession(w http.ResponseWriter, r *http.Request)
 		Path:     "/",
 		Expires:  expiresAt,
 		HttpOnly: true,
+		Secure:   a.isSecureRequest(r),
 		SameSite: http.SameSiteLaxMode,
 	})
 
@@ -124,6 +140,7 @@ func (a *AuthService) AttachUserToSession(w http.ResponseWriter, r *http.Request
 		Path:     "/",
 		Expires:  expiresAt,
 		HttpOnly: true,
+		Secure:   a.isSecureRequest(r),
 		SameSite: http.SameSiteLaxMode,
 	})
 
@@ -142,6 +159,8 @@ func (a *AuthService) Logout(w http.ResponseWriter, r *http.Request) {
 		Expires:  time.Unix(0, 0),
 		MaxAge:   -1,
 		HttpOnly: true,
+		Secure:   a.isSecureRequest(r),
+		SameSite: http.SameSiteLaxMode,
 	})
 }