paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 48 Packages Projects Releases Wiki Activity

Merge pull request #1785 from spotify/rugvip/salmon

Browse Source 
auth-backend: set SameSite=Lax for oauth flow cookies
This commit is contained in:
Patrik Oldsberg
2020-07-30 15:10:50 +02:00
committed by GitHub
parent 679f24fc61 54610c9ba4
commit 69d7f9cc92
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-backend/src/lib/OAuthProvider.ts
+4 -4
View File
@@ -248,7 +248,7 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
res.cookie(`${this.options.providerId}-nonce`, nonce, {
maxAge: TEN_MINUTES_MS,
secure: this.options.secure,
sameSite: 'none',
sameSite: 'lax',
domain: this.domain,
path: `${this.basePath}/${this.options.providerId}/handler`,
httpOnly: true,
@@ -259,7 +259,7 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
res.cookie(`${this.options.providerId}-scope`, scope, {
maxAge: TEN_MINUTES_MS,
secure: this.options.secure,
sameSite: 'none',
sameSite: 'lax',
domain: this.domain,
path: `${this.basePath}/${this.options.providerId}/handler`,
httpOnly: true,
@@ -277,7 +277,7 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
res.cookie(`${this.options.providerId}-refresh-token`, refreshToken, {
maxAge: THOUSAND_DAYS_MS,
secure: this.options.secure,
sameSite: 'none',
sameSite: 'lax',
domain: this.domain,
path: `${this.basePath}/${this.options.providerId}`,
httpOnly: true,
@@ -288,7 +288,7 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
res.cookie(`${this.options.providerId}-refresh-token`, '', {
maxAge: 0,
secure: false,
sameSite: 'none',
sameSite: 'lax',
domain: `${this.domain}`,
path: `${this.basePath}/${this.options.providerId}`,
httpOnly: true,