The makeCookie method in ticket.go was using t.options.Secret directly, which meant cookie-secret-file was not being respected. Updated to use GetSecret() which handles both cookie-secret and cookie-secret-file properly.

Also added test coverage for cookie-secret-file functionality.

Fixes #3224

Description

The makeCookie method in ticket.go was directly accessing t.options.Secret when signing cookie values. This meant that when users configured a cookie-secret-file, the secret from the file was not being used.

Changes made:

• Updated makeCookie to use t.options.GetSecret() which properly handles both cookie-secret and cookie-secret-file
• Added test coverage in session_store_tests.go to verify cookie signing works with secrets loaded from files

Motivation and Context

When users configure oauth2-proxy with cookie-secret-file, they expect the secret from that file to be used for all cookie operations. However, due to this bug, the makeCookie method was bypassing the file-based secret mechanism and only using the direct secret value.

This fixes issue #3224 where it was reported that cookie signing was broken when using cookie-secret-file.

How Has This Been Tested?

• Added a new test context "with cookie secret file" to the session store test suite
• Test creates a temporary file with a random 32-byte secret
• Verifies that session store operations work correctly when using only cookie-secret-file (with empty Secret)
• All existing tests continue to pass with no modifications needed
• Ran the full test suite with Go 1.24.6 on Linux

Checklist:

• My change requires a change to the documentation or CHANGELOG.
• I have updated the documentation/CHANGELOG accordingly.
• I have created a feature (non-master) branch for my PR.
• I have written tests for my code changes.