From d4723024a08dfc1c5ec8fd584adcad3b49022b70 Mon Sep 17 00:00:00 2001 From: gearnode Date: Thu, 6 Mar 2025 08:33:38 +0100 Subject: [PATCH] Use signed cookie Signed-off-by: gearnode --- pkg/api/console/v1/cookie.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/api/console/v1/cookie.go b/pkg/api/console/v1/cookie.go index 60643cbf3..775c1a16a 100644 --- a/pkg/api/console/v1/cookie.go +++ b/pkg/api/console/v1/cookie.go @@ -6,9 +6,12 @@ import ( // setSessionCookie sets a session cookie in the response func setSessionCookie(w http.ResponseWriter, sessionID string, cfg AuthConfig) { + // Sign the session ID + signedValue := signCookieValue(sessionID, cfg.CookieSecret) + cookie := &http.Cookie{ Name: cfg.CookieName, - Value: sessionID, + Value: signedValue, Path: cfg.CookiePath, Domain: cfg.CookieDomain, Secure: cfg.CookieSecure,