package auth

import (
	"net/http"
)

const CookieName = "ATC-Authorization"

type CookieSetHandler struct {
	Handler http.Handler
}

func (handler CookieSetHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	cookie, err := r.Cookie(CookieName)
	if err == nil && r.Header.Get("Authorization") == "" {
		r.Header.Set("Authorization", cookie.Value)
	}

	handler.Handler.ServeHTTP(w, r)
}

package auth

import (
	"net/http"
)

const CookieName = "ATC-Authorization"

type CookieSetHandler struct {
	Handler http.Handler
}

func (handler CookieSetHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	cookie, err := r.Cookie(CookieName)
	if err == nil && r.Header.Get("Authorization") == "" {
		r.Header.Set("Authorization", cookie.Value)

	}

	handler.Handler.ServeHTTP(w, r)
}

Add X- headers for security
Add X- headers for security

X-XSS, X-Content-Type-Options, X-Download-Options have sane defaults,
but X-Frame-Options would break existing functionality of including
concourse on iframes if we added this header by default.

Instead, we expose what to put in this header in the ATC flags,
defaulting it to no header.

[#142094977]

Signed-off-by: Anisha Hirji <234e666d587164a63e127013ae06c9fdf954d431@pivotal.io>
