github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-23 21:16:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(cookie): use samesite lax instead of none for callback

Browse Source
This commit is contained in:
Trong Huu Nguyen
2023-12-19 08:46:03 +01:00
parent c3904433f2
commit 273eb3604a
2 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/handler/handler.go
+2 -2
View File
@@ -132,7 +132,7 @@ func (s *Standalone) Login(w http.ResponseWriter, r *http.Request) {
opts := s.GetCookieOptions(r).
WithExpiresIn(1 * time.Hour).
WithSameSite(http.SameSiteNoneMode)
WithSameSite(http.SameSiteLaxMode)
err = login.SetCookie(w, opts, s.Crypter, canonicalRedirect)
if err != nil {
s.InternalError(w, r, fmt.Errorf("login: setting cookie: %w", err))
@@ -177,7 +177,7 @@ func (s *Standalone) LoginCallback(w http.ResponseWriter, r *http.Request) {
logger := mw.LogEntryFrom(r)
// unconditionally clear login cookies
cookie.Clear(w, cookie.Login, opts.WithSameSite(http.SameSiteNoneMode))
cookie.Clear(w, cookie.Login, opts.WithSameSite(http.SameSiteLaxMode))
cookie.Clear(w, cookie.LoginLegacy, opts.WithSameSite(http.SameSiteDefaultMode))
loginCookie, err := openid.GetLoginCookie(r, s.Crypter)