login pimpout

server/src/net.rs

@@ -17,7 +17,7 @@ use payments::{stripe};
 
 pub const TOKEN_HEADER: &str = "x-auth-token";
 pub const AUTH_CLEAR: &str =
-    "x-auth-token=; HttpOnly; SameSite=Strict; Max-Age=-1;";
+    "x-auth-token=; HttpOnly; SameSite=Strict; Path=/; Max-Age=-1;";
 
 #[derive(Clone, Copy, Fail, Debug, Serialize, Deserialize)]
 pub enum MnmlHttpError {
@@ -163,6 +163,7 @@ fn token_res(token: String) -> Response {
     let v = Cookie::build(TOKEN_HEADER, token)
         .http_only(true)
         .same_site(SameSite::Strict)
+        .path("/")
         .max_age(Duration::weeks(1)) // 1 week aligns with db set
         .finish();
 
@@ -265,9 +266,9 @@ pub fn start(pool: PgPool) {
     let mut router = Router::new();
 
     // auth
-    router.post("/api/login", login, "login");
-    router.post("/api/logout", logout, "logout");
-    router.post("/api/register", register, "register");
+    router.post("/api/account/login", login, "login");
+    router.post("/api/account/logout", logout, "logout");
+    router.post("/api/account/register", register, "register");
 
     // payments
     router.post("/api/payments/stripe", stripe, "stripe");