rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make secure cookie configurable

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-11-04 17:09:51 +01:00
parent 549775fd71
commit fee5a9232e
20 changed files with 94 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/server/api/api.go
View File

@@ -20,6 +20,10 @@ import (
"time"
"github.com/go-chi/chi/v5"
"github.com/go-chi/cors"
"go.gearno.de/kit/httpserver"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/connector"
@@ -28,10 +32,6 @@ import (
console_v1 "go.probo.inc/probo/pkg/server/api/console/v1"
trust_v1 "go.probo.inc/probo/pkg/server/api/trust/v1"
"go.probo.inc/probo/pkg/trust"
"github.com/go-chi/chi/v5"
"github.com/go-chi/cors"
"go.gearno.de/kit/httpserver"
"go.gearno.de/kit/log"
)
type (
@@ -40,6 +40,7 @@ type (
CookieDomain string
SessionDuration time.Duration
CookieSecret string
CookieSecure bool
}
TrustAuthConfig struct {
@@ -51,6 +52,7 @@ type (
TokenSecret string
Scope string
TokenType string
CookieSecure bool
}
Config struct {
@@ -128,6 +130,7 @@ func NewServer(cfg Config) (*Server, error) {
CookieDomain: cfg.ConsoleAuth.CookieDomain,
SessionDuration: cfg.ConsoleAuth.SessionDuration,
CookieSecret: cfg.ConsoleAuth.CookieSecret,
CookieSecure: cfg.ConsoleAuth.CookieSecure,
},
trust_v1.TrustAuthConfig{
CookieName: cfg.TrustAuth.CookieName,
@@ -138,6 +141,7 @@ func NewServer(cfg Config) (*Server, error) {
TokenSecret: cfg.TrustAuth.TokenSecret,
Scope: cfg.TrustAuth.Scope,
TokenType: cfg.TrustAuth.TokenType,
CookieSecure: cfg.TrustAuth.CookieSecure,
},
)
@@ -191,6 +195,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
CookieDomain: s.cfg.ConsoleAuth.CookieDomain,
SessionDuration: s.cfg.ConsoleAuth.SessionDuration,
CookieSecret: s.cfg.ConsoleAuth.CookieSecret,
CookieSecure: s.cfg.ConsoleAuth.CookieSecure,
},
s.cfg.ConnectorRegistry,
s.cfg.SafeRedirect,

2
pkg/server/api/console/v1/resolver.go
View File

@@ -54,6 +54,7 @@ type (
CookieDomain string
SessionDuration time.Duration
CookieSecret string
CookieSecure bool
}
Resolver struct {
@@ -371,6 +372,7 @@ func WithSession(authSvc *auth.Service, authzSvc *authz.Service, authCfg AuthCon
sessionAuthCfg := session.AuthConfig{
CookieName: authCfg.CookieName,
CookieSecret: authCfg.CookieSecret,
CookieSecure: authCfg.CookieSecure,
}
errorHandler := session.ErrorHandler{

4
pkg/server/api/trust/v1/resolver.go
View File

@@ -52,6 +52,7 @@ type (
TokenSecret string
Scope string
TokenType string
CookieSecure bool
}
Resolver struct {
@@ -186,6 +187,7 @@ func trySessionAuth(ctx context.Context, w http.ResponseWriter, r *http.Request,
sessionAuthCfg := session.AuthConfig{
CookieName: authCfg.CookieName,
CookieSecret: authCfg.CookieSecret,
CookieSecure: authCfg.CookieSecure,
}
errorHandler := session.ErrorHandler{
@@ -256,7 +258,7 @@ func clearTokenCookie(w http.ResponseWriter, trustAuthCfg TrustAuthConfig) {
Domain: trustAuthCfg.CookieDomain,
Path: "/",
MaxAge: -1,
Secure: true,
Secure: trustAuthCfg.CookieSecure,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
})

5
pkg/server/api/trust/v1/trust_center_access_handler.go
View File

@@ -110,7 +110,7 @@ func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) htt
Domain: cookieDomain,
Path: "/",
MaxAge: int(trustAuthCfg.CookieDuration / time.Second),
Secure: true,
Secure: trustAuthCfg.CookieSecure,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
}
@@ -159,7 +159,7 @@ func trustCenterLogoutHandler(authCfg console_v1.AuthConfig, trustAuthCfg TrustA
Domain: cookieDomain,
Path: "/",
MaxAge: -1,
Secure: true,
Secure: trustAuthCfg.CookieSecure,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
})
@@ -167,6 +167,7 @@ func trustCenterLogoutHandler(authCfg console_v1.AuthConfig, trustAuthCfg TrustA
session.ClearCookie(w, session.AuthConfig{
CookieName: authCfg.CookieName,
CookieSecret: authCfg.CookieSecret,
CookieSecure: authCfg.CookieSecure,
})
httpserver.RenderJSON(w, http.StatusOK, map[string]string{