fix: bugs

Signed-off-by: Eric Lin <38420555+Ezzahhh@users.noreply.github.com>

Author: Ezzahhh

main.go

@@ -23,7 +23,7 @@ type Config struct {
 func CreateConfig() *Config {
 	return &Config{
 		AuthRequestHeaders:  []string{"Cookie", "X-Forwarded-Proto", "X-Forwarded-Host"},
-		AuthResponseHeaders: []string{"X-Vouch-User"},
+		AuthResponseHeaders: []string{"X-Vouch-User", "X-Vouch-Token"},
 		AuthCheckTimeout:    5 * time.Second,
 	}
 }
@@ -105,13 +105,17 @@ func (e *VouchPlugin) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 
 	// 4. CASE: Authorized (200 OK)
 	if authResp.StatusCode >= 200 && authResp.StatusCode < 300 {
+		// If Vouch refreshes the session, we must tell the browser to update the cookie.
+		for _, cookie := range authResp.Cookies() {
+			http.SetCookie(rw, cookie)
+		}
 		// Copy configured headers from Vouch -> Downstream App
 		for _, headerName := range e.authRespHeaders {
 			if val := authResp.Header.Get(headerName); val != "" {
 				req.Header.Set(headerName, val)
 			}
 		}
-		req.Header.Del("Cookie")
+		// req.Header.Del("Cookie")
 		e.next.ServeHTTP(rw, req)
 		return
 	}