GX6009: origin with cookies is not exact

Cause#

gx.AllowCredentials has an origin with a wildcard, or gx.AnyOrigin. A request from an origin of gx.AllowCredentials carries the cookies of the user. A wildcard trusts each subdomain that exists now or later, and one bad subdomain can then write as each user.

Example#

package app

import "github.com/alternayte/gx"

// Mount mounts the routes that a different origin can call.
func Mount(app *gx.App) {
	app.Group("/widgets", gx.AllowCredentials("https://*.acme.dev"))
}

gx lint reports:

app/mount.go:7:44: GX6009: an origin of gx.AllowCredentials must be exact; a wildcard trusts each later subdomain with the session of the user

Fix#

1. List each origin that needs the cookies: gx.AllowCredentials("https://app.acme.dev").
2. For each other origin, use gx.AllowOrigins. It takes a wildcard and gx.AnyOrigin. A request from such an origin has no cookie, so give the user with a token.