From b7a520b8ef410d422db653d2680a2aafe3341013 Mon Sep 17 00:00:00 2001 From: mo khan Date: Thu, 8 May 2025 09:53:24 -0600 Subject: feat: use a cookie prefix to lock down the session cookie > __Host-: If a cookie name has this prefix, it's accepted in a > Set-Cookie header only if it's also marked with the Secure attribute, > was sent from a secure origin, does not include a Domain attribute, > and has the Path attribute set to /. In other words, the cookie is > domain-locked. https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#cookie_prefixes --- app/middleware/token_parser.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'app/middleware/token_parser.go') diff --git a/app/middleware/token_parser.go b/app/middleware/token_parser.go index f64522b..08219b4 100644 --- a/app/middleware/token_parser.go +++ b/app/middleware/token_parser.go @@ -4,6 +4,7 @@ import ( "net/http" "github.com/xlgmokha/x/pkg/x" + "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/oidc" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/web" @@ -12,7 +13,7 @@ import ( type TokenParser x.Mapper[*http.Request, oidc.RawToken] func IDTokenFromSessionCookie(r *http.Request) oidc.RawToken { - cookies := r.CookiesNamed("session") + cookies := r.CookiesNamed(cfg.SessionCookie) if len(cookies) != 1 { return "" -- cgit v1.2.3