notfire/Iceshrimp.NET
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[frontend] Set session cookies SameSite attribute to Lax (ISH-381)

Browse source
This commit is contained in:
Lilian 2024-06-21 21:49:03 +02:00 • committed by Iceshrimp development
parent 8b61186449
commit e8ecee4c76
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Iceshrimp.Frontend/Core/Services/SessionService.cs
View file

@ -63,24 +63,24 @@ internal class SessionService
Current = null; Current = null;
LocalStorage.RemoveItem("last_user"); LocalStorage.RemoveItem("last_user");
((IJSInProcessRuntime)Js).InvokeVoid("eval", ((IJSInProcessRuntime)Js).InvokeVoid("eval",
$"document.cookie = \"admin_session=; Fri, 31 Dec 1000 23:59:59 GMT SameSite=Strict\""); $"document.cookie = \"admin_session= ; Fri, 31 Dec 1000 23:59:59 GMT SameSite=Lax\"");
} }
public void SetSession(string id) public void SetSession(string id)
{ {
((IJSInProcessRuntime)Js).InvokeVoid("eval", ((IJSInProcessRuntime)Js).InvokeVoid("eval",
$"document.cookie = \"admin_session=; expires=Fri, 31 Dec 1000 23:59:59 GMT SameSite=Strict\""); $"document.cookie = \"admin_session= ; expires=Fri, 31 Dec 1000 23:59:59 GMT SameSite=Lax\"");
var user = GetUserById(id); var user = GetUserById(id);
if (user == null) throw new Exception("Did not find User in Local Storage"); if (user == null) throw new Exception("Did not find User in Local Storage");
ApiService.SetBearerToken(user.Token); ApiService.SetBearerToken(user.Token);
Current = user; Current = user;
LocalStorage.SetItem("last_user", user.Id); LocalStorage.SetItem("last_user", user.Id);
((IJSInProcessRuntime)Js).InvokeVoid("eval", ((IJSInProcessRuntime)Js).InvokeVoid("eval",
$"document.cookie = \"session={user.Id}; expires=Fri, 31 Dec 9999 23:59:59 GMT; SameSite=Strict\""); $"document.cookie = \"session={user.Id}; expires=Fri, 31 Dec 9999 23:59:59 GMT; SameSite=Lax\"");
if (user.IsAdmin) if (user.IsAdmin)
{ {
((IJSInProcessRuntime)Js).InvokeVoid("eval", ((IJSInProcessRuntime)Js).InvokeVoid("eval",
$"document.cookie = \"admin_session={user.Token}; expires=Fri, 31 Dec 9999 23:59:59 GMT; SameSite=Strict\""); $"document.cookie = \"admin_session={user.Token}; expires=Fri, 31 Dec 9999 23:59:59 GMT; SameSite=Lax\"");
} }
// Security implications of this need a second pass? user.Id should never be user controllable, but still. // Security implications of this need a second pass? user.Id should never be user controllable, but still.
} }