Ryan Hamamura 72d31fd143 fix: convert auth flows from SSE to standard HTTP to fix session cookies ...

Datastar's NewSSE() flushes HTTP headers before SCS's session middleware
can attach the Set-Cookie header, so the session cookie never reaches the
browser after login/register/logout.

Convert login, register, and logout to standard HTML forms with HTTP
redirects, which lets SCS write cookies normally. Also fix return_url
capture on the login page (was never being stored in the session).

Add handler tests covering login, register, and logout flows.

2026-03-11 10:10:28 -10:00

521 B

Raw Permalink Blame History

View Raw