TyleoDvDelaware3217/GoDoxy
1
0
Fork 0
mirror of https://github.com/yusing/godoxy.git synced 2025-07-06 22:44:03 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: update cookie security settings to use API_JWT_SECURE environment variable

Browse source
This commit is contained in:
yusing 2025-03-28 08:51:45 +08:00
parent 2da7ea56d5
commit f966ca8b83
3 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
internal/api/v1/auth/oidc.go
View file

@ -197,7 +197,7 @@ func (auth *OIDCProvider) RedirectLoginPage(w http.ResponseWriter, r *http.Reque
MaxAge: 300, MaxAge: 300,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
Secure: r.TLS != nil, Secure: common.APIJWTSecure,
Path: "/", Path: "/",
}) })

4
internal/api/v1/auth/utils.go
View file

@ -5,6 +5,7 @@ import (
"net/http" "net/http"
"time" "time"
"github.com/yusing/go-proxy/internal/common"
"github.com/yusing/go-proxy/internal/gperr" "github.com/yusing/go-proxy/internal/gperr"
"github.com/yusing/go-proxy/internal/utils/strutils" "github.com/yusing/go-proxy/internal/utils/strutils"
) )
@ -43,7 +44,7 @@ func setTokenCookie(w http.ResponseWriter, r *http.Request, name, value string,
MaxAge: int(ttl.Seconds()), MaxAge: int(ttl.Seconds()),
Domain: cookieFQDN(r), Domain: cookieFQDN(r),
HttpOnly: true, HttpOnly: true,
Secure: r.TLS != nil, Secure: common.APIJWTSecure,
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
Path: "/", Path: "/",
}) })
@ -56,6 +57,7 @@ func clearTokenCookie(w http.ResponseWriter, r *http.Request, name string) {
MaxAge: -1, MaxAge: -1,
Domain: cookieFQDN(r), Domain: cookieFQDN(r),
HttpOnly: true, HttpOnly: true,
Secure: common.APIJWTSecure,
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
Path: "/", Path: "/",
}) })

1
internal/common/env.go
View file

@ -36,6 +36,7 @@ var (
PrometheusEnabled = GetEnvBool("PROMETHEUS_ENABLED", false) PrometheusEnabled = GetEnvBool("PROMETHEUS_ENABLED", false)
APIJWTSecure = GetEnvBool("API_JWT_SECURE", true)
APIJWTSecret = decodeJWTKey(GetEnvString("API_JWT_SECRET", "")) APIJWTSecret = decodeJWTKey(GetEnvString("API_JWT_SECRET", ""))
APIJWTTokenTTL = GetDurationEnv("API_JWT_TOKEN_TTL", time.Hour) APIJWTTokenTTL = GetDurationEnv("API_JWT_TOKEN_TTL", time.Hour)
APIUser = GetEnvString("API_USER", "admin") APIUser = GetEnvString("API_USER", "admin")