Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BC-8974 make session cookie httponly and set samesite #3592

Merged
merged 4 commits into from
Feb 18, 2025
Merged

BC-8974 make session cookie httponly and set samesite #3592

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
917b57e
BC-8974 make session cookie httponly and set samesite
Loki-Afro Feb 12, 2025
bc93643
fix some docker build warnings
Loki-Afro Feb 13, 2025
9bc9004
Merge branch 'main' into bc-8974
CeEv Feb 18, 2025
2a30863
default to strict as there are no complaints so far
Loki-Afro Feb 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM docker.io/node:22 as git
FROM docker.io/node:22 AS git

RUN mkdir /app && chown -R node:node /app
WORKDIR /app
Expand Down Expand Up @@ -55,4 +55,4 @@ COPY --from=git /app/version /home/node/app/static/version
# "build" .. this basically throws out non relevant files for the theme under build and does scss to css stuff
RUN export NODE_OPTIONS=--openssl-legacy-provider && node node_modules/gulp/bin/gulp.js clear-cache && node node_modules/gulp/bin/gulp.js

CMD npm start
CMD ["npm", "start"]
4 changes: 3 additions & 1 deletion app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,9 @@ if (redisUrl) {
const SIX_HOURS = 1000 * 60 * 60 * 6;
app.use(session({
cookie: {
// TODO ...cookieDefaults,
httpOnly: true,
sameSite: Configuration.get('SESSION_COOKIE_SAME_SITE'),
secure: 'auto',
maxAge: SIX_HOURS,
},
rolling: true, // refresh session with every request within maxAge
Expand Down
5 changes: 5 additions & 0 deletions config/default.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,6 +279,11 @@
"default": "",
"description": "A string with concatenated user types (student, employee) that don't need to explicitly state their consent with the terms and conditions. \"employee\" means teachers and admins"
},
"SESSION_COOKIE_SAME_SITE": {
"type": "string",
"default": "strict",
"description": "express-session cookie samesite attribute"
},
"COOKIE": {
"type": "object",
"description": "Cookie properties, required always to be defined",
Expand Down
Loading