mirrors/pomme
1
0
Fork 0
mirror of https://git.freecumextremist.com/grumbulon/pomme.git synced 2024-12-22 17:40:43 +00:00
Code Issues Releases Wiki Activity

fix(backend): make cookie more strict

Browse source 
THIS IS STILL NOT ENOUGH!

Signed-off-by: Sam Therapy <sam@samtherapy.net>
This commit is contained in:
Sam Therapy 2023-02-20 18:05:09 +01:00
parent 3df52fd618
commit 5d52caab70
Signed by: sam
GPG key ID: 4D8B07C18F31ACBD
2 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
internal/api/auth.go
View file

@ -98,11 +98,11 @@ func Login(w http.ResponseWriter, r *http.Request) {
HttpOnly: true,
Expires: time.Now().Add(1 * time.Hour),
MaxAge: 3600,
SameSite: http.SameSiteLaxMode,
// Uncomment below for HTTPS:
// Secure: true,
Name: "jwt", // Must be named "jwt" or else the token cannot be searched for by jwtauth.Verifier.
Value: token,
SameSite: http.SameSiteStrictMode,
// Comment below to disable HTTPS:
Secure: true,
Name: "jwt", // Must be named "jwt" or else the token cannot be searched for by jwtauth.Verifier.
Value: token,
})
w.Header().Set("Content-Type", "application/json; charset=utf-8")
@ -120,10 +120,10 @@ func Logout(w http.ResponseWriter, r *http.Request) {
http.SetCookie(w, &http.Cookie{
HttpOnly: true,
MaxAge: -1, // Delete the cookie.
SameSite: http.SameSiteLaxMode,
// Secure: true,
Name: "jwt",
Value: "",
SameSite: http.SameSiteStrictMode,
Secure: true,
Name: "jwt",
Value: "",
})
w.Header().Set("Content-Type", "application/json; charset=utf-8")

10
internal/api/users.go
View file

@ -71,11 +71,11 @@ func NewUser(w http.ResponseWriter, r *http.Request) {
HttpOnly: true,
Expires: time.Now().Add(1 * time.Hour),
MaxAge: 3600,
SameSite: http.SameSiteLaxMode,
// Uncomment below for HTTPS:
// Secure: true,
Name: "jwt", // Must be named "jwt" or else the token cannot be searched for by jwtauth.Verifier.
Value: token,
SameSite: http.SameSiteStrictMode,
// Comment below to disable HTTPS:
Secure: true,
Name: "jwt", // Must be named "jwt" or else the token cannot be searched for by jwtauth.Verifier.
Value: token,
})
w.Header().Set("Content-Type", "application/json; charset=utf-8")