Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-07 14:50:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

web UI cookie: set the Secure flags if we are over TLS

Browse Source
This commit is contained in:
Nicola Murino
2021-01-28 13:29:16 +01:00
parent 9985224966
commit afe1da92c5
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
httpd/auth_utils.go
View File

@@ -107,7 +107,7 @@ func (c *jwtTokenClaims) createTokenResponse(tokenAuth *jwtauth.JWTAuth) (map[st
return response, nil return response, nil
} }
func (c *jwtTokenClaims) createAndSetCookie(w http.ResponseWriter, tokenAuth *jwtauth.JWTAuth) error { func (c *jwtTokenClaims) createAndSetCookie(w http.ResponseWriter, r *http.Request, tokenAuth *jwtauth.JWTAuth) error {
resp, err := c.createTokenResponse(tokenAuth) resp, err := c.createTokenResponse(tokenAuth)
if err != nil { if err != nil {
return err return err
@@ -118,6 +118,7 @@ func (c *jwtTokenClaims) createAndSetCookie(w http.ResponseWriter, tokenAuth *jw
Path: webBasePath, Path: webBasePath,
Expires: time.Now().Add(tokenDuration), Expires: time.Now().Add(tokenDuration),
HttpOnly: true, HttpOnly: true,
Secure: r.TLS != nil,
}) })
return nil return nil
@@ -130,6 +131,7 @@ func (c *jwtTokenClaims) removeCookie(w http.ResponseWriter, r *http.Request) {
Path: webBasePath, Path: webBasePath,
MaxAge: -1, MaxAge: -1,
HttpOnly: true, HttpOnly: true,
Secure: r.TLS != nil,
}) })
invalidateToken(r) invalidateToken(r)
} }

4
httpd/server.go
View File

@@ -128,7 +128,7 @@ func (s *httpdServer) handleWebLoginPost(w http.ResponseWriter, r *http.Request)
Signature: admin.GetSignature(), Signature: admin.GetSignature(),
} }
err = c.createAndSetCookie(w, s.tokenAuth) err = c.createAndSetCookie(w, r, s.tokenAuth)
if err != nil { if err != nil {
renderLoginPage(w, err.Error()) renderLoginPage(w, err.Error())
return return
@@ -224,7 +224,7 @@ func (s *httpdServer) checkCookieExpiration(w http.ResponseWriter, r *http.Reque
} }
} }
logger.Debug(logSender, "", "cookie refreshed for admin %#v", admin.Username) logger.Debug(logSender, "", "cookie refreshed for admin %#v", admin.Username)
tokenClaims.createAndSetCookie(w, s.tokenAuth) //nolint:errcheck tokenClaims.createAndSetCookie(w, r, s.tokenAuth) //nolint:errcheck
} }
func (s *httpdServer) updateContextFromCookie(r *http.Request) *http.Request { func (s *httpdServer) updateContextFromCookie(r *http.Request) *http.Request {