Skip to content

Commit

Permalink
only use __Host prefix if https is enabled
Browse files Browse the repository at this point in the history
  • Loading branch information
stonith404 committed Jan 24, 2025
1 parent d34f8b4 commit 186e2fb
Show file tree
Hide file tree
Showing 9 changed files with 55 additions and 33 deletions.
12 changes: 10 additions & 2 deletions backend/internal/controller/user_controller.go
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
package controller

import (
"github.com/stonith404/pocket-id/backend/internal/utils/cookie"
"net/http"
"strconv"
"time"

"github.com/gin-gonic/gin"
Expand Down Expand Up @@ -184,7 +186,10 @@ func (uc *UserController) exchangeOneTimeAccessTokenHandler(c *gin.Context) {
return
}

utils.AddAccessTokenCookie(c, uc.appConfigService.DbConfig.SessionDuration.Value, token)
sessionDurationInMinutesParsed, _ := strconv.Atoi(uc.appConfigService.DbConfig.SessionDuration.Value)
maxAge := sessionDurationInMinutesParsed * 60
cookie.AddAccessTokenCookie(c, maxAge, token)

c.JSON(http.StatusOK, userDto)
}

Expand All @@ -201,7 +206,10 @@ func (uc *UserController) getSetupAccessTokenHandler(c *gin.Context) {
return
}

utils.AddAccessTokenCookie(c, uc.appConfigService.DbConfig.SessionDuration.Value, token)
sessionDurationInMinutesParsed, _ := strconv.Atoi(uc.appConfigService.DbConfig.SessionDuration.Value)
maxAge := sessionDurationInMinutesParsed * 60
cookie.AddAccessTokenCookie(c, maxAge, token)

c.JSON(http.StatusOK, userDto)
}

Expand Down
18 changes: 11 additions & 7 deletions backend/internal/controller/webauthn_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,9 @@ import (
"github.com/stonith404/pocket-id/backend/internal/common"
"github.com/stonith404/pocket-id/backend/internal/dto"
"github.com/stonith404/pocket-id/backend/internal/middleware"
"github.com/stonith404/pocket-id/backend/internal/utils"
"github.com/stonith404/pocket-id/backend/internal/utils/cookie"
"net/http"
"strconv"
"time"

"github.com/gin-gonic/gin"
Expand Down Expand Up @@ -42,12 +43,12 @@ func (wc *WebauthnController) beginRegistrationHandler(c *gin.Context) {
return
}

c.SetCookie("session_id", options.SessionID, int(options.Timeout.Seconds()), "/", "", true, true)
cookie.AddSessionIdCookie(c, int(options.Timeout.Seconds()), options.SessionID)
c.JSON(http.StatusOK, options.Response)
}

func (wc *WebauthnController) verifyRegistrationHandler(c *gin.Context) {
sessionID, err := c.Cookie("session_id")
sessionID, err := c.Cookie(cookie.SessionIdCookieName)
if err != nil {
c.Error(&common.MissingSessionIdError{})
return
Expand Down Expand Up @@ -76,12 +77,12 @@ func (wc *WebauthnController) beginLoginHandler(c *gin.Context) {
return
}

c.SetCookie("session_id", options.SessionID, int(options.Timeout.Seconds()), "/", "", true, true)
cookie.AddSessionIdCookie(c, int(options.Timeout.Seconds()), options.SessionID)
c.JSON(http.StatusOK, options.Response)
}

func (wc *WebauthnController) verifyLoginHandler(c *gin.Context) {
sessionID, err := c.Cookie("session_id")
sessionID, err := c.Cookie(cookie.SessionIdCookieName)
if err != nil {
c.Error(&common.MissingSessionIdError{})
return
Expand All @@ -105,7 +106,10 @@ func (wc *WebauthnController) verifyLoginHandler(c *gin.Context) {
return
}

utils.AddAccessTokenCookie(c, wc.appConfigService.DbConfig.SessionDuration.Value, token)
sessionDurationInMinutesParsed, _ := strconv.Atoi(wc.appConfigService.DbConfig.SessionDuration.Value)
maxAge := sessionDurationInMinutesParsed * 60
cookie.AddAccessTokenCookie(c, maxAge, token)

c.JSON(http.StatusOK, userDto)
}

Expand Down Expand Up @@ -165,6 +169,6 @@ func (wc *WebauthnController) updateCredentialHandler(c *gin.Context) {
}

func (wc *WebauthnController) logoutHandler(c *gin.Context) {
utils.AddAccessTokenCookie(c, "0", "")
cookie.AddAccessTokenCookie(c, 0, "")
c.Status(http.StatusNoContent)
}
3 changes: 2 additions & 1 deletion backend/internal/middleware/jwt_auth.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"github.com/gin-gonic/gin"
"github.com/stonith404/pocket-id/backend/internal/common"
"github.com/stonith404/pocket-id/backend/internal/service"
"github.com/stonith404/pocket-id/backend/internal/utils/cookie"
"strings"
)

Expand All @@ -19,7 +20,7 @@ func NewJwtAuthMiddleware(jwtService *service.JwtService, ignoreUnauthenticated
func (m *JwtAuthMiddleware) Add(adminOnly bool) gin.HandlerFunc {
return func(c *gin.Context) {
// Extract the token from the cookie or the Authorization header
token, err := c.Cookie("__Host-access_token")
token, err := c.Cookie(cookie.AccessTokenCookieName)
if err != nil {
authorizationHeaderSplitted := strings.Split(c.GetHeader("Authorization"), " ")
if len(authorizationHeaderSplitted) == 2 {
Expand Down
13 changes: 13 additions & 0 deletions backend/internal/utils/cookie/add_cookie.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
package cookie

import (
"github.com/gin-gonic/gin"
)

func AddAccessTokenCookie(c *gin.Context, maxAgeInSeconds int, token string) {
c.SetCookie(AccessTokenCookieName, token, maxAgeInSeconds, "/", "", true, true)
}

func AddSessionIdCookie(c *gin.Context, maxAgeInSeconds int, sessionID string) {
c.SetCookie(SessionIdCookieName, sessionID, maxAgeInSeconds, "/", "", true, true)
}
16 changes: 16 additions & 0 deletions backend/internal/utils/cookie/cookie_names.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
package cookie

import (
"github.com/stonith404/pocket-id/backend/internal/common"
"strings"
)

var AccessTokenCookieName = "__Host-access_token"
var SessionIdCookieName = "__Host-session"

func init() {
if strings.HasPrefix(common.EnvConfig.AppURL, "http://") {
AccessTokenCookieName = "access_token"
SessionIdCookieName = "session"
}
}
12 changes: 0 additions & 12 deletions backend/internal/utils/cookie_util.go

This file was deleted.

4 changes: 3 additions & 1 deletion frontend/src/lib/constants.ts
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
export const ACCESS_TOKEN_COOKIE_NAME = '__Host-access_token';
export const ACCESS_TOKEN_COOKIE_NAME = process.env.PUBLIC_APP_URL?.startsWith('http://')
? 'access_token'
: '__Host-access_token';
5 changes: 0 additions & 5 deletions reverse-proxy/Caddyfile.dev

This file was deleted.

5 changes: 0 additions & 5 deletions reverse-proxy/Caddyfile.trust-proxy
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,4 @@
reverse_proxy /* http://localhost:{$PORT:3000} {
trusted_proxies 0.0.0.0/0
}

log {
output file /var/log/caddy/access.log
level WARN
}
}

0 comments on commit 186e2fb

Please sign in to comment.