paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

Merge pull request #13556 from backstage/eide/allow-third-party-cookies

Browse Source 
[auth-backend]: Calculate `SameSite` cookie attribute in defaultCookieConfigurer and default to `none`
This commit is contained in:
Patrik Oldsberg
2022-09-20 17:20:22 +02:00
committed by GitHub
parent 25b94e6345 d0f7bb0291
commit 272fce8325
7 changed files with 456 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/kind-penguins-report.md
+10
View File
@@ -0,0 +1,10 @@
---
'@backstage/plugin-auth-backend': minor
---
CookieConfigurer can optionally return the `SameSite` cookie attribute.
CookieConfigurer now requires an additional argument `appOrigin` - the origin URL of the app - which is used to calculate the `SameSite` attribute.
defaultCookieConfigurer returns the `SameSite` attribute which defaults to `Lax`. In cases where an auth-backend is running on a different domain than the App, `SameSite=None` is used - but only for secure contexts. This is so that cookies can be included in third-party requests.
OAuthAdapterOptions has been modified to require additional arguments, `baseUrl`, and `cookieConfigurer`.
OAuthAdapter now resolves cookie configuration using its supplied CookieConfigurer for each request to make sure that the proper attributes always are set.