fix(api): http cookies properties (#5792)

fsamin · web-flow · commit 0a1ebf7766a0 · 2021-04-14T15:51:25.000+02:00
Signed-off-by: francois  samin &lt;francois.samin@corp.ovh.com&gt;
diff --git a/engine/api/api.go b/engine/api/api.go
@@ -878,26 +878,29 @@ func (a *API) Serve(ctx context.Context) error {
 // This will returns a cookie with no expiration date that should be dropped by browser when closed.
 func (a *API) SetCookieSession(w http.ResponseWriter, name, value string) {
 	a.setCookie(w, &http.Cookie{
-		Name:  name,
-		Value: value,
+		Name:     name,
+		Value:    value,
+		HttpOnly: false,
 	})
 }
 
 // SetCookie on given response writter, automatically add domain and path based on api config.
-func (a *API) SetCookie(w http.ResponseWriter, name, value string, expires time.Time) {
+func (a *API) SetCookie(w http.ResponseWriter, name, value string, expires time.Time, httpOnly bool) {
 	a.setCookie(w, &http.Cookie{
-		Name:    name,
-		Value:   value,
-		Expires: expires,
+		Name:     name,
+		Value:    value,
+		Expires:  expires,
+		HttpOnly: httpOnly,
 	})
 }
 
 // UnsetCookie on given response writter, automatically add domain and path based on api config.
-func (a *API) UnsetCookie(w http.ResponseWriter, name string) {
+func (a *API) UnsetCookie(w http.ResponseWriter, name string, httpOnly bool) {
 	a.setCookie(w, &http.Cookie{
-		Name:   name,
-		Value:  "",
-		MaxAge: -1,
+		Name:     name,
+		Value:    "",
+		MaxAge:   -1,
+		HttpOnly: httpOnly,
 	})
 }
 
@@ -910,6 +913,12 @@ func (a *API) setCookie(w http.ResponseWriter, c *http.Cookie) {
 			c.Path = "/"
 		}
 	}
+	c.SameSite = http.SameSiteStrictMode
+	c.Secure = true
+	uiURL, _ := url.Parse(a.Config.URL.UI)
+	if uiURL != nil && uiURL.Hostname() != "" {
+		c.Domain = uiURL.Hostname()
+	}
 	http.SetCookie(w, c)
 }
 
diff --git a/engine/api/auth.go b/engine/api/auth.go
@@ -291,7 +291,7 @@ func (api *API) postAuthSigninHandler() service.Handler {
 		}
 
 		// Set a cookie with the jwt token
-		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)
+		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)
 
 		// Prepare http response
 		resp := sdk.AuthConsumerSigninResponse{
@@ -313,7 +313,7 @@ func (api *API) postAuthSignoutHandler() service.Handler {
 		}
 
 		// Delete the jwt cookie value
-		api.UnsetCookie(w, service.JWTCookieName)
+		api.UnsetCookie(w, service.JWTCookieName, true)
 
 		return service.WriteJSON(w, nil, http.StatusOK)
 	}
@@ -356,7 +356,7 @@ func (api *API) postAuthDetachHandler() service.Handler {
 
 		// If we just removed the current consumer, clean http cookie.
 		if consumer.ID == currentConsumer.ID {
-			api.UnsetCookie(w, service.JWTCookieName)
+			api.UnsetCookie(w, service.JWTCookieName, true)
 		}
 
 		return service.WriteJSON(w, nil, http.StatusOK)
diff --git a/engine/api/auth_builtin.go b/engine/api/auth_builtin.go
@@ -65,7 +65,7 @@ func (api *API) postAuthBuiltinSigninHandler() service.Handler {
 		}
 
 		// Set a cookie with the jwt token
-		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)
+		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)
 
 		usr, err := user.LoadByID(ctx, tx, consumer.AuthentifiedUserID)
 		if err != nil {
diff --git a/engine/api/auth_local.go b/engine/api/auth_local.go
@@ -220,7 +220,7 @@ func (api *API) postAuthLocalSigninHandler() service.Handler {
 		}
 
 		// Set a cookie with the jwt token
-		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)
+		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)
 
 		// Prepare http response
 		resp := sdk.AuthConsumerSigninResponse{
@@ -353,7 +353,7 @@ func (api *API) postAuthLocalVerifyHandler() service.Handler {
 		local.CleanVerifyConsumerToken(api.Cache, consumer.ID)
 
 		// Set a cookie with the jwt token
-		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)
+		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)
 
 		// Prepare http response
 		resp := sdk.AuthConsumerSigninResponse{
@@ -521,7 +521,7 @@ func (api *API) postAuthLocalResetHandler() service.Handler {
 		local.CleanResetConsumerToken(api.Cache, consumer.ID)
 
 		// Set a cookie with the jwt token
-		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)
+		api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)
 
 		// Prepare http response
 		resp := sdk.AuthConsumerSigninResponse{

Original file line number	Diff line number	Diff line change
`@@ -291,7 +291,7 @@ func (api *API) postAuthSigninHandler() service.Handler {`
`291`	`291`	`}`
`292`	`292`
`293`	`293`	`// Set a cookie with the jwt token`
`294`		`- api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)`
	`294`	`+ api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)`
`295`	`295`
`296`	`296`	`// Prepare http response`
`297`	`297`	`resp := sdk.AuthConsumerSigninResponse{`
`@@ -313,7 +313,7 @@ func (api *API) postAuthSignoutHandler() service.Handler {`
`313`	`313`	`}`
`314`	`314`
`315`	`315`	`// Delete the jwt cookie value`
`316`		`- api.UnsetCookie(w, service.JWTCookieName)`
	`316`	`+ api.UnsetCookie(w, service.JWTCookieName, true)`
`317`	`317`
`318`	`318`	`return service.WriteJSON(w, nil, http.StatusOK)`
`319`	`319`	`}`
`@@ -356,7 +356,7 @@ func (api *API) postAuthDetachHandler() service.Handler {`
`356`	`356`
`357`	`357`	`// If we just removed the current consumer, clean http cookie.`
`358`	`358`	`if consumer.ID == currentConsumer.ID {`
`359`		`- api.UnsetCookie(w, service.JWTCookieName)`
	`359`	`+ api.UnsetCookie(w, service.JWTCookieName, true)`
`360`	`360`	`}`
`361`	`361`
`362`	`362`	`return service.WriteJSON(w, nil, http.StatusOK)`
Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,7 @@ func (api *API) postAuthBuiltinSigninHandler() service.Handler {`
`65`	`65`	`}`
`66`	`66`
`67`	`67`	`// Set a cookie with the jwt token`
`68`		`- api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt)`
	`68`	`+ api.SetCookie(w, service.JWTCookieName, jwt, session.ExpireAt, true)`
`69`	`69`
`70`	`70`	`usr, err := user.LoadByID(ctx, tx, consumer.AuthentifiedUserID)`
`71`	`71`	`if err != nil {`