paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 41 Packages Projects Releases Wiki Activity

Calculate SameSite attribute more carefully, defaulting to lax in most cases

Browse Source 
Signed-off-by: Marcus Eide <eide@spotify.com>
This commit is contained in:
Marcus Eide
2022-09-09 11:16:04 +02:00
parent 5fa831ce55
commit 12943d1ade
7 changed files with 193 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/kind-penguins-report.md
+5 -2
View File
@@ -1,5 +1,8 @@
---
'@backstage/plugin-auth-backend': patch
'@backstage/plugin-auth-backend': minor
---
Allow CookieConfigurer to optionally return the SameSite cookie attribute. Return `SameSite=None` in `defaultCookieConfigurer` for secure contexts to allow cookies to be included in third-party requests.
CookieConfigurer can optionally return the `SameSite` cookie attribute.
CookieConfigurer now requires an additional argument `appOrigin` - the origin URL of the app - which is used to calculate the `SameSite` attribute.
defaultCookieConfigurer returns the `SameSite` attribute which defaults to `Lax`. In cases where an auth-backend is running on a different domain than the App, `SameSite=None` is used - but only for secure contexts. This is so that cookies can be included in third-party requests.
OAuthAdapterOptions has been modified to require additional arguments, `baseUrl`, `cookieConfigurer` and `cookieConfig`.