security: harden first preview boundaries

Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

authhttp/authhttp_test.go

@@ -36,6 +36,13 @@ func TestCookieRequiresHostPrefix(t *testing.T) {
 	}
 }
 
+func TestSessionCookieRejectsShortToken(t *testing.T) {
+	config := CookieConfig{Name: "__Host-app_session", Lifetime: time.Hour}
+	if err := SetSession(httptest.NewRecorder(), config, "predictable", time.Unix(100, 0)); err == nil {
+		t.Fatal("short session token accepted")
+	}
+}
+
 func TestCSRFUsesSessionAndPurpose(t *testing.T) {
 	token := strings.Repeat("s", 43)
 	csrf, err := CSRFToken(token, "profile:update")
@@ -65,6 +72,37 @@ func TestOptionalFailsClosedWhenSessionStorageIsUnavailable(t *testing.T) {
 	}
 }
 
+func TestOptionalFailsClosedWhenConfigurationIsInvalid(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		service *auth.Service
+		config  CookieConfig
+	}{
+		{name: "nil service", config: CookieConfig{Name: "__Host-app_session", Lifetime: time.Hour}},
+		{name: "invalid cookie", service: mustAuthService(t), config: CookieConfig{Name: "session", Lifetime: time.Hour}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			handler := Optional(test.service, test.config)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+				t.Fatal("handler ran with invalid authentication configuration")
+			}))
+			response := httptest.NewRecorder()
+			handler.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "https://example.test/", nil))
+			if response.Code != http.StatusServiceUnavailable || response.Header().Get("Cache-Control") != "no-store" {
+				t.Fatalf("status=%d cache=%q", response.Code, response.Header().Get("Cache-Control"))
+			}
+		})
+	}
+}
+
+func mustAuthService(t *testing.T) *auth.Service {
+	t.Helper()
+	service, err := auth.New(authHTTPRepository{}, auth.Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return service
+}
+
 type authHTTPRepository struct{ err error }
 
 func (authHTTPRepository) CreateUser(context.Context, auth.User, string) error { return nil }