devstack/authorizer
4
0
Fork 0
Code Pull Requests Actions Activity

feat(dashboard): allow setting admin / app cookie security

Browse Source 
Fixes #233
This commit is contained in:
Lakhan Samani
2022-10-02 22:01:22 +05:30
parent 4e1bba2ba8
commit 9cb011e921
11 changed files with 193 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/cookie/cookie.go
View File

@@ -29,8 +29,7 @@ func SetSession(gc *gin.Context, sessionID string) {
domain = "." + domain
}
// Use sameSite = lax by default
// Since app cookie can come from cross site it becomes important to set this in lax mode.
// Since app cookie can come from cross site it becomes important to set this in lax mode when insecure.
// Example person using custom UI on their app domain and making request to authorizer domain.
// For more information check:
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite