fix: set cookies alongside header when SendJWTHeader is enabled (#262)

* fix: set cookies alongside header when SendJWTHeader is enabled

When SendJWTHeader is true, now sets both the JWT header AND cookies.
This fixes OAuth authentication flows where HTTP headers don't survive
browser redirects. Cookies are needed for the OAuth callback to complete
successfully, while headers are still set for direct API calls.

Fixes umputun/remark42#1877

* test: add XSRF cookie value assertion in SendJWTHeader test

verify XSRF-TOKEN cookie value matches claims ID for consistency
with TestJWT_SetWithDomain

---------

Co-authored-by: Umputun <umputun@gmail.com>

Author: paskal

token/jwt.go

@@ -249,7 +249,8 @@ func (j *Service) Set(w http.ResponseWriter, claims Claims) (Claims, error) {
 
 	if j.SendJWTHeader {
 		w.Header().Set(j.JWTHeaderKey, tokenString)
-		return claims, nil
+		// don't return here - fall through to also set cookies
+		// cookies are needed for OAuth redirect flows where headers don't survive redirects
 	}
 
 	cookieExpiration := 0 // session cookie

token/jwt_test.go

@@ -263,7 +263,12 @@ func TestJWT_SendJWTHeader(t *testing.T) {
 	assert.NoError(t, err)
 	cookies := rr.Result().Cookies()
 	t.Log(cookies)
-	require.Equal(t, 0, len(cookies), "no cookies set")
+	// cookies are set alongside header to support OAuth redirect flows
+	require.Equal(t, 2, len(cookies), "cookies set alongside header")
+	assert.Equal(t, "JWT", cookies[0].Name)
+	assert.Equal(t, testJwtValid, cookies[0].Value)
+	assert.Equal(t, "XSRF-TOKEN", cookies[1].Name)
+	assert.Equal(t, "random id", cookies[1].Value)
 	assert.Equal(t, testJwtValid, rr.Result().Header.Get("X-JWT"))
 }
 

v2/token/jwt.go

@@ -266,7 +266,8 @@ func (j *Service) Set(w http.ResponseWriter, claims Claims) (Claims, error) {
 
 	if j.SendJWTHeader {
 		w.Header().Set(j.JWTHeaderKey, tokenString)
-		return claims, nil
+		// don't return here - fall through to also set cookies
+		// cookies are needed for OAuth redirect flows where headers don't survive redirects
 	}
 
 	cookieExpiration := 0 // session cookie

v2/token/jwt_test.go

@@ -263,7 +263,12 @@ func TestJWT_SendJWTHeader(t *testing.T) {
 	assert.NoError(t, err)
 	cookies := rr.Result().Cookies()
 	t.Log(cookies)
-	require.Equal(t, 0, len(cookies), "no cookies set")
+	// cookies are set alongside header to support OAuth redirect flows
+	require.Equal(t, 2, len(cookies), "cookies set alongside header")
+	assert.Equal(t, "JWT", cookies[0].Name)
+	assert.Equal(t, testJwtValid, cookies[0].Value)
+	assert.Equal(t, "XSRF-TOKEN", cookies[1].Name)
+	assert.Equal(t, "random id", cookies[1].Value)
 	assert.Equal(t, testJwtValid, rr.Result().Header.Get("X-JWT"))
 }