From 20ca7cfa5fa831359d8cd6b3618a117d6b8305fd Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 10 Jan 2022 17:35:02 +0100 Subject: [PATCH] auth-backend: switch over to use auto secure cookies Signed-off-by: Patrik Oldsberg --- .changeset/slimy-eggs-carry.md | 7 +++++++ plugins/auth-backend/src/service/router.ts | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 .changeset/slimy-eggs-carry.md diff --git a/.changeset/slimy-eggs-carry.md b/.changeset/slimy-eggs-carry.md new file mode 100644 index 0000000000..a58a3d8c61 --- /dev/null +++ b/.changeset/slimy-eggs-carry.md @@ -0,0 +1,7 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Switched the secure cookie mode set on the `express-session` to use `'auto'` rather than `true`. This works around an issue where cookies would not be set if TLS termination was handled in a proxy rather than having the backend served directly with HTTPS. + +The downside of this change is that secure cookies won't be used unless the backend is directly served with HTTPS. This will be remedied in a future update that allows the backend to configured for trusted proxy mode. diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts index deef6ddcf0..6fdd768498 100644 --- a/plugins/auth-backend/src/service/router.ts +++ b/plugins/auth-backend/src/service/router.ts @@ -74,7 +74,7 @@ export async function createRouter( secret, saveUninitialized: false, resave: false, - cookie: { secure: enforceCookieSSL }, + cookie: { secure: enforceCookieSSL ? 'auto' : false }, }), ); router.use(passport.initialize());