Sign session cookie to avoid tapping

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/api/console/v1/auth_handlers.go

@@ -176,8 +176,15 @@ func LogoutHandler(usrmgrSvc *usrmgr.Service, authCfg AuthConfig) http.HandlerFu
 			return
 		}
 
+		// Verify the cookie signature
+		originalValue, err := verifyCookieValue(cookie.Value, authCfg.CookieSecret)
+		if err != nil {
+			http.Error(w, "Invalid session cookie", http.StatusBadRequest)
+			return
+		}
+
 		// Parse the session ID
-		sessionID, err := gid.ParseGID(cookie.Value)
+		sessionID, err := gid.ParseGID(originalValue)
 		if err != nil {
 			http.Error(w, "Invalid session ID", http.StatusBadRequest)
 			return

pkg/api/console/v1/resolver.go

@@ -44,6 +44,7 @@ type (
 		CookieDomain    string
 		CookiePath      string
 		SessionDuration time.Duration
+		CookieSecret    string
 	}
 
 	Resolver struct {
@@ -143,20 +144,24 @@ func graphqlHandler(proboSvc *probo.Service, usrmgrSvc *usrmgr.Service, authCfg
 		// Extract session from cookie
 		cookie, err := r.Cookie(authCfg.CookieName)
 		if err == nil && cookie.Value != "" {
-			// Parse the session ID
-			sessionID, err := gid.ParseGID(cookie.Value)
+			// Verify the cookie signature
+			originalValue, err := verifyCookieValue(cookie.Value, authCfg.CookieSecret)
 			if err == nil {
-				// Get the session
-				session, err := usrmgrSvc.GetSession(r.Context(), sessionID)
+				// Parse the session ID
+				sessionID, err := gid.ParseGID(originalValue)
 				if err == nil {
-					// Add session to context
-					ctx = context.WithValue(ctx, sessionContextKey, session)
-
-					// Get the user
-					user, err := usrmgrSvc.GetUserBySession(r.Context(), sessionID)
+					// Get the session
+					session, err := usrmgrSvc.GetSession(r.Context(), sessionID)
 					if err == nil {
-						// Add user to context
-						ctx = context.WithValue(ctx, userContextKey, user)
+						// Add session to context
+						ctx = context.WithValue(ctx, sessionContextKey, session)
+
+						// Get the user
+						user, err := usrmgrSvc.GetUserBySession(r.Context(), sessionID)
+						if err == nil {
+							// Add user to context
+							ctx = context.WithValue(ctx, userContextKey, user)
+						}
 					}
 				}
 			}