Allow setting session secret cookie code

handlers.go

@@ -33,10 +33,11 @@ func serve(
 	defaultPassword string,
 	debounce int,
 	diary bool,
+	secret string,
 ) {
 	gin.SetMode(gin.ReleaseMode)
 	router := gin.Default()
-	store := sessions.NewCookieStore([]byte("secret"))
+	store := sessions.NewCookieStore([]byte(secret))
 	router.Use(sessions.Sessions("mysession", store))
 	router.HTMLRender = loadTemplates("index.tmpl")
 	// router.Use(static.Serve("/static/", static.LocalFile("./static", true)))

main.go

@@ -51,6 +51,7 @@ func main() {
 			c.GlobalString("lock"),
 			c.GlobalInt("debounce"),
 			c.GlobalBool("diary"),
+			c.GlobalString("cookie-secret"),
 		)
 		return nil
 	}
@@ -117,6 +118,11 @@ func main() {
 			Name:  "diary",
 			Usage: "turn diary mode (doing New will give a timestamped page)",
 		},
+		cli.StringFlag{
+			Name:  "cookie-secret",
+			Value: "secret",
+			Usage: "random data to use for cookies; changing it will invalidate all sessions",
+		},
 	}
 	app.Commands = []cli.Command{
 		{