forgejo/routers
Nils Goroll 31fff54e17
Improvement: Do not set session cookie for empty session
This is based on https://code.forgejo.org/go-chi/session/pulls/80.

The remainder of this message is largely copied from there:

For interoperability with reverse proxies and CDNs, setting a session
cookie for no good reason (login is a good reason) is a PITA, because it
makes caching of content for anonymous (not logged-in) users very hard,
requiring all kinds of special casing and error prone workarounds.

In particular in an age of exploitative AI bot crawling, being able to
serve content for anonymous users from a fast, efficient page cache is
an important option.

This patch lays a foundation by using an option added to go-chi/session
to not create session cookies always, but rather only when the
respective session is non-empty.

Test cases are included there and omitted here.
2026-03-11 04:18:06 +01:00
..
api fix: remove second challenge from WWW-Authenticate header (#11616) 2026-03-10 21:07:08 +01:00
common Improvement: Do not set session cookie for empty session 2026-03-11 04:18:06 +01:00
install fix: don't clobber authorized_keys file during installation (#10948) 2026-01-23 18:38:09 +01:00
private refactor: replace ActionRunnerToken.OwnerID & RepoID with optional.Option[int64] (#11601) 2026-03-10 03:19:16 +01:00
utils [PORT] drop utils.IsExternalURL (and expand IsRiskyRedirectURL tests) (#3167) 2024-04-15 13:03:08 +00:00
web fix(ui): improve Git notes editing (#11365) 2026-03-10 23:49:18 +01:00
init.go fix: don't clobber authorized_keys file during installation (#10948) 2026-01-23 18:38:09 +01:00