rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make auth cookie SameSite configurable

Browse Source 
Add same-site to auth cookie config with lax as the default,
PROBOD_AUTH_COOKIE_SAMESITE bootstrap mapping, and validation
that rejects none unless Secure is enabled.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Cursor Agent
2026-07-29 16:37:28 +00:00
committed by Bryan Frimin
parent cd6c46212a
commit 62d0ab68c4
9 changed files with 266 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/bootstrap/builder.go
View File

@@ -59,6 +59,13 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
pgCACertBundle := b.getPgCACertBundle()
authCookieSameSite, err := probodconfig.ParseCookieSameSite(
b.resolver.getEnvOrDefault("PROBOD_AUTH_COOKIE_SAMESITE", "lax"),
)
if err != nil {
return nil, fmt.Errorf("cannot parse PROBOD_AUTH_COOKIE_SAMESITE: %w", err)
}
cfg := &probodconfig.FullConfig{
Unit: probodconfig.UnitConfig{
Metrics: probodconfig.MetricsConfig{
@@ -118,6 +125,7 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
Secret: b.resolver.getEnv("PROBOD_AUTH_COOKIE_SECRET"),
Duration: b.resolver.getEnvIntOrDefault("PROBOD_AUTH_COOKIE_DURATION", 24),
Secure: b.resolver.getEnvBoolOrDefault("PROBOD_AUTH_COOKIE_SECURE", true),
SameSite: authCookieSameSite,
},
Password: probodconfig.PasswordConfig{
Pepper: b.resolver.getEnv("PROBOD_AUTH_PASSWORD_PEPPER"),
@@ -559,6 +567,10 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
return nil, b.resolver.Err()
}
if err := cfg.Probod.Auth.Cookie.Validate(); err != nil {
return nil, fmt.Errorf("cannot validate auth cookie config: %w", err)
}
return cfg, nil
}