8000 fix cookie options · devel0/example-webapp-with-auth@edd175c · GitHub
[go: up one dir, main page]
Skip to content

Commit edd175c

Browse files
devel0devel0
committed
fix cookie options
1 parent 55a3dba commit edd175c

File tree

2 files changed

+53
-49
lines changed

2 files changed

+53
-49
lines changed

‎src/backend/Extensions/Auth.cs

Lines changed: 15 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -73,14 +73,15 @@ public static void SetupApplicationCookie(this WebApplicationBuilder builder)
7373
builder.Services.ConfigureApplicationCookie(configure =>
7474
{
7575
configure.Cookie.Name = WEB_ApplicationCookieName;
76-
77-
builder.Environment.SetCookieOptions(configure.Cookie);
76+
configure.Cookie.SecurePolicy = CookieSecurePolicy.Always;
77+
configure.Cookie.HttpOnly = true;
78+
configure.Cookie.SameSite = SameSiteMode.Strict;
7879
});
7980
}
8081

8182
/// <summary>
8283
/// Add Identity provider with custom <see cref="ApplicationUser"/> user and system <see cref="IdentityRole"/> role management.
83-
/// Add <see cref="ApplicationDbContext"/> ef store for the identities.
84+
/// Add <see cref="AppDbContext"/> ef store for the identities.
8485
/// Add default token providers.
8586
/// </summary>
8687
public static void SetupIdentityProvider(this IServiceCollection serviceCollection) => serviceCollection
@@ -101,11 +102,7 @@ public static List<string> GetRoles(this IEnumerable<Claim> claims) =>
101102
claims.Where(r => r.Type == ClaimTypes.Role).Select(w => w.Value).ToList();
102103

103104
/// <summary>
104-
/// Get JWT token validation parameters from given options and current configuration.
105-
/// <seealso cref="CONFIG_KEY_JwtSettings_Issuer"/>
106-
/// <seealso cref="CONFIG_KEY_JwtSettings_Audience"/>
107-
/// <seealso cref="CONFIG_KEY_JwtSettings_Key"/>
108-
/// <seealso cref="CONFIG_KEY_JwtSettings_ClockSkewSeconds"/>
105+
/// Get JWT token validation parameters from given options and current configuration.
109106
/// </summary>
110107
/// <param name="validateIssuer">Will validate issuer (default: true).</param>
111108
/// <param name="validateAudience">Will validate audience (default: true).</param>
@@ -189,8 +186,16 @@ userManager is not null && logger is not null &&
189186
{
190187
var opts = new CookieOptions();
191188

192-
hostEnvironment.SetCookieOptions(builder.Configuration, opts, setExpiresAsRefreshToken: true);
193-
context.HttpContext.Response.Cookies.Append(WEB_CookieName_XAccessToken, res.AccessToken, opts);
189+
context.HttpContext.Response.Cookies.Append(
190+
WEB_CookieName_XAccessToken,
191+
res.AccessToken,
192+
new CookieOptions
193+
{
194+
Secure = true,
195+
HttpOnly = true,
196+
SameSite = SameSiteMode.Strict,
197+
Expires = DateTimeOffset.UtcNow + builder.Configuration.GetAppConfig().Auth.Jwt.AccessTokenDuration
198+
});
194199

195200
context.Principal = res.Principal;
196201
context.Success();
@@ -211,37 +216,4 @@ userManager is not null && logger is not null &&
211216

212217
});
213218

214-
/// <summary>
215-
/// Configure given CookieBuilder to set Secure, HttpOnly and Strict SameSite options on created cookies.
216-
/// </summary>
217-
public static void SetCookieOptions(this IHostEnvironment environment, CookieBuilder cookieBuilder)
218-
{
219-
cookieBuilder.SecurePolicy = CookieSecurePolicy.Always;
220-
cookieBuilder.HttpOnly = true;
221-
cookieBuilder.SameSite = SameSiteMode.Strict;
222-
}
223-
224-
/// <summary>
225-
/// Configure given CookieOptions to set Secure, HttpOnly and Strict SameSite options on created cookies.
226-
/// </summary>
227-
/// <param name="environment"></param>
228-
/// <param name="configuration"></param>
229-
/// <param name="cookieOptions"></param>
230-
/// <param name="setExpiresAsRefreshToken">if true set expiration time as from JwtSettings:RefreshTokenDurationSeconds</param>
231-
public static void SetCookieOptions(this IHostEnvironment environment, IConfiguration configuration,
232-
CookieOptions cookieOptions, bool setExpiresAsRefreshToken = false)
233-
{
234-
cookieOptions.Secure = true;
235-
cookieOptions.HttpOnly = true;
236-
cookieOptions.SameSite = SameSiteMode.Strict;
237-
238-
if (setExpiresAsRefreshToken)
239-
{
240-
var cookieDuration = configuration.GetAppConfig().Auth.Jwt.RefreshTokenDuration;
241-
242-
cookieOptions.Expires = DateTimeOffset.Now.Add(cookieDuration);
243-
}
244-
}
245-
246-
247219
}

‎src/backend/Services/Implementations/Auth/AuthService.cs

Lines changed: 38 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
using Org.BouncyCastle.Bcpg.Sig;
2+
13
namespace ExampleWebApp.Backend.WebApi.Services.Auth;
24

35
public class AuthService : IAuthService
@@ -150,9 +152,30 @@ public async Task<LoginResponseDto> LoginAsync(
150152

151153
var userName = user.UserName!;
152154

153-
environment.SetCookieOptions(configuration, opts, setExpiresAsRefreshToken: true);
154-
httpContext.Response.Cookies.Append(WEB_CookieName_XAccessToken, accessToken, opts);
155-
httpContext.Response.Cookies.Append(WEB_CookieName_XRefreshToken, refreshTokenNfo.RefreshToken, opts);
155+
var appConfig = configuration.GetAppConfig();
156+
157+
// environment.SetCookieOptions(configuration, opts, setExpiresAsRefreshToken: true);
158+
httpContext.Response.Cookies.Append(
159+
WEB_CookieName_XAccessToken,
160+
accessToken,
161+
new CookieOptions
162+
{
163+
Secure = true,
164+
HttpOnly = true,
165+
SameSite = SameSiteMode.Strict,
166+
Expires = DateTimeOffset.UtcNow + appConfig.Auth.Jwt.AccessTokenDuration
167+
});
168+
169+
httpContext.Response.Cookies.Append(
170+
WEB_CookieName_XRefreshToken,
171+
refreshTokenNfo.RefreshToken,
172+
new CookieOptions
173+
{
174+
Secure = true,
175+
HttpOnly = true,
176+
SameSite = SameSiteMode.Strict,
177+
Expires = DateTimeOffset.UtcNow + appConfig.Auth.Jwt.RefreshTokenDuration
178+
});
156179

157180
var roles = claims.GetRoles();
158181

@@ -250,9 +273,18 @@ public async Task<RenewRefreshTokenResponse> RenewCurrentUserRefreshTokenAsync(C
250273
if (renewedRefreshTokenNfo is null)
251274
return new RenewRefreshTokenResponse { Status = RenewRefreshTokenStatus.InvalidRefreshToken };
252275

253-
var opts = new CookieOptions();
254-
environment.SetCookieOptions(configuration, opts, setExpiresAsRefreshToken: true);
255-
httpContext.Response.Cookies.Append(WEB_CookieName_XRefreshToken, renewedRefreshTokenNfo.RefreshToken, opts);
276+
// var opts = new CookieOptions();
277+
// environment.SetCookieOptions(configuration, opts, setExpiresAsRefreshToken: true);
278+
httpContext.Response.Cookies.Append(
279+
WEB_CookieName_XRefreshToken,
280+
renewedRefreshTokenNfo.RefreshToken,
281+
new CookieOptions
282+
{
283+
Secure = true,
284+
5D42 HttpOnly = true,
285+
SameSite = SameSiteMode.Strict,
286+
Expires = DateTimeOffset.UtcNow + configuration.GetAppConfig().Auth.Jwt.RefreshTokenDuration
287+
});
256288

257289
return new RenewRefreshTokenResponse { Status = RenewRefreshTokenStatus.OK, RefreshTokenNfo = renewedRefreshTokenNfo };
258290
}

0 commit comments

Comments
 (0)
0