From e3b11376cb93a5637e192dea7dc1f375f5a75bf6 Mon Sep 17 00:00:00 2001 From: Fidel Coria Date: Wed, 22 Dec 2021 10:22:12 -0600 Subject: [PATCH 1/4] fix: enforce cookie ssl in production Signed-off-by: Fidel Coria --- plugins/auth-backend/src/service/router.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts index 6a96d421da..6451207d2d 100644 --- a/plugins/auth-backend/src/service/router.ts +++ b/plugins/auth-backend/src/service/router.ts @@ -68,7 +68,8 @@ export async function createRouter( if (secret) { router.use(cookieParser(secret)); // TODO: Configure the server-side session storage. The default MemoryStore is not designed for production - router.use(session({ secret, saveUninitialized: false, resave: false })); + const enforceCookieSSL = process.env.NODE_ENV === 'production'; + router.use(session({ secret, saveUninitialized: false, resave: false, cookie: { secure: enforceCookieSSL } })); router.use(passport.initialize()); router.use(passport.session()); } else { From eb48e78886d10960ae316164de322bf0042bdbdb Mon Sep 17 00:00:00 2001 From: Fidel Coria Date: Wed, 22 Dec 2021 10:27:14 -0600 Subject: [PATCH 2/4] add changeset Signed-off-by: Fidel Coria --- .changeset/twenty-hornets-train.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/twenty-hornets-train.md diff --git a/.changeset/twenty-hornets-train.md b/.changeset/twenty-hornets-train.md new file mode 100644 index 0000000000..492404b573 --- /dev/null +++ b/.changeset/twenty-hornets-train.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Enforce cookie ssl protection when in production for auth-backend sessions From 5801adbd18509948219c4b8b0b17a43b1892d8f7 Mon Sep 17 00:00:00 2001 From: Fidel Coria Date: Wed, 22 Dec 2021 10:47:36 -0600 Subject: [PATCH 3/4] use authUrl for condition Signed-off-by: Fidel Coria --- plugins/auth-backend/src/service/router.ts | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts index 6451207d2d..deef6ddcf0 100644 --- a/plugins/auth-backend/src/service/router.ts +++ b/plugins/auth-backend/src/service/router.ts @@ -68,8 +68,15 @@ export async function createRouter( if (secret) { router.use(cookieParser(secret)); // TODO: Configure the server-side session storage. The default MemoryStore is not designed for production - const enforceCookieSSL = process.env.NODE_ENV === 'production'; - router.use(session({ secret, saveUninitialized: false, resave: false, cookie: { secure: enforceCookieSSL } })); + const enforceCookieSSL = authUrl.startsWith('https'); + router.use( + session({ + secret, + saveUninitialized: false, + resave: false, + cookie: { secure: enforceCookieSSL }, + }), + ); router.use(passport.initialize()); router.use(passport.session()); } else { From 27073a49a128a5f86efcca70404c2b8aaafbe6aa Mon Sep 17 00:00:00 2001 From: Fidel Coria Date: Wed, 22 Dec 2021 10:50:11 -0600 Subject: [PATCH 4/4] fix spelling in changeset Signed-off-by: Fidel Coria --- .changeset/twenty-hornets-train.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/twenty-hornets-train.md b/.changeset/twenty-hornets-train.md index 492404b573..957bfd00da 100644 --- a/.changeset/twenty-hornets-train.md +++ b/.changeset/twenty-hornets-train.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend': patch --- -Enforce cookie ssl protection when in production for auth-backend sessions +Enforce cookie SSL protection when in production for auth-backend sessions