diff options
| author | mo khan <mo@mokhan.ca> | 2025-05-08 09:53:24 -0600 |
|---|---|---|
| committer | mo khan <mo@mokhan.ca> | 2025-05-08 09:53:24 -0600 |
| commit | b7a520b8ef410d422db653d2680a2aafe3341013 (patch) | |
| tree | 30a2a8f278684f006bbb846cbdd560c9080bcfaf /app/controllers/sessions/controller.go | |
| parent | e9b9d1058504f8331bf03e6168074ef7cedab519 (diff) | |
feat: use a cookie prefix to lock down the session cookie
> __Host-: If a cookie name has this prefix, it's accepted in a
> Set-Cookie header only if it's also marked with the Secure attribute,
> was sent from a secure origin, does not include a Domain attribute,
> and has the Path attribute set to /. In other words, the cookie is
> domain-locked.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#cookie_prefixes
Diffstat (limited to 'app/controllers/sessions/controller.go')
| -rw-r--r-- | app/controllers/sessions/controller.go | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/app/controllers/sessions/controller.go b/app/controllers/sessions/controller.go index 7860ed5..61fdaf8 100644 --- a/app/controllers/sessions/controller.go +++ b/app/controllers/sessions/controller.go @@ -6,6 +6,7 @@ import ( "github.com/xlgmokha/x/pkg/cookie" "github.com/xlgmokha/x/pkg/log" + "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/middleware" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/oidc" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls" @@ -37,7 +38,7 @@ func (c *Controller) New(w http.ResponseWriter, r *http.Request) { url, nonce := c.svc.GenerateRedirectURL() // This cookie must be sent as part of a redirect that originates from the OIDC Provider cookie.Write(w, web.NewCookie( - "oauth_state", + cfg.CSRFCookie, nonce, cookie.WithSameSite(http.SameSiteLaxMode), cookie.WithExpiration(time.Now().Add(10*time.Minute)), @@ -140,7 +141,7 @@ func (c *Controller) Create(w http.ResponseWriter, r *http.Request) { return } - ck := web.NewCookie("session", encoded, + ck := web.NewCookie(cfg.SessionCookie, encoded, cookie.WithSameSite(http.SameSiteLaxMode), cookie.WithExpiration(tokens.Expiry), ) |