Fix Broken User Authentication in Chi

r.Post("/login", func(w http.ResponseWriter, r *http.Request) {
    user := r.FormValue("username")
    pass := r.FormValue("password")
// VULN: Plaintext comparison and hardcoded logic
if user == "admin" && pass == "admin123" {
    // VULN: Session cookie lacks HttpOnly, Secure, and SameSite flags
    // VULN: Session ID is predictable and not cryptographically signed
    http.SetCookie(w, &http.Cookie{
        Name:  "session_id",
        Value: user,
    })
    w.Write([]byte("Welcome back"))
} else {
    http.Error(w, "Unauthorized", http.StatusUnauthorized)
}
})

r.Post("/login", func(w http.ResponseWriter, r *http.Request) {
    // 1. Authenticate against DB using bcrypt.CompareHashAndPassword
    // 2. Use a secure session manager (e.g., gorilla/sessions)
    session, _ := store.Get(r, "auth-session")
session.Values["user_id"] = authenticatedUserID
session.Values["authenticated"] = true

// Enforce secure cookie attributes
session.Options = &sessions.Options{
    Path:     "/",
    MaxAge:   3600,
    HttpOnly: true,   // Mitigates XSS-based session theft
    Secure:   true,   // Ensures cookie is sent over HTTPS only
    SameSite: http.SameSiteStrictMode, // Mitigates CSRF
}

if err := session.Save(r, w); err != nil {
    http.Error(w, "Internal Server Error", 500)
    return
}
w.WriteHeader(http.StatusOK)
})