.tip

May 3, 2026 · one of the small things

Run shellcheck on every script in CI

Shell has more ways to be subtly wrong than any language people actually use. shellcheck knows most of them: unquoted variables, [ ] versus [[ ]], $? after a pipe, the lot.

shellcheck scripts/*.sh .github/scripts/*

It runs in a second. Most of what it finds is a bug you have not hit yet because the file name has never had a space in it.

shellci

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close