starred/pocket-id-pocket-id-2
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-09 14:42:59 +03:00
Code Issues 116 Packages Projects Releases 10 Wiki Activity

[PR #175] [MERGED] fix: add __HOST prefix to cookies #935

New Issue
Closed
opened 2025-10-09 17:00:04 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2025-10-09 17:00:04 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/pocket-id/pocket-id/pull/175
Author: @stonith404
Created: 1/24/2025
Status: ✅ Merged
Merged: 1/24/2025
Merged by: @stonith404

Base: main ← Head: fix/host-cookies

📝 Commits (2)

  • d34f8b4 add __HOST prefix to cookies
  • 4e568e5 only use __Host prefix if https is enabled

📊 Changes

21 files changed (+80 additions, -46 deletions)

View changed files

📝 backend/internal/controller/user_controller.go (+10 -2)
📝 backend/internal/controller/webauthn_controller.go (+11 -7)
📝 backend/internal/middleware/jwt_auth.go (+2 -1)
➕ backend/internal/utils/cookie/add_cookie.go (+13 -0)
➕ backend/internal/utils/cookie/cookie_names.go (+16 -0)
➖ backend/internal/utils/cookie_util.go (+0 -12)
📝 frontend/src/hooks.server.ts (+2 -1)
➕ frontend/src/lib/constants.ts (+2 -0)
📝 frontend/src/routes/+layout.server.ts (+3 -2)
📝 frontend/src/routes/authorize/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/account/+page.server.ts (+3 -2)
📝 frontend/src/routes/settings/admin/application-configuration/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/admin/oidc-clients/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/admin/oidc-clients/[id]/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/admin/user-groups/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/admin/user-groups/[id]/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/admin/users/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/admin/users/[id]/+page.server.ts (+2 -1)
📝 frontend/src/routes/settings/audit-log/+page.server.ts (+2 -1)
📝 reverse-proxy/Caddyfile (+0 -5)

...and 1 more files

📄 Description

Fixes #171. Without the __HOST prefix another subdomain could write the "access_token" cookie which results in a redirection loop.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/pocket-id/pocket-id/pull/175 **Author:** [@stonith404](https://github.com/stonith404) **Created:** 1/24/2025 **Status:** ✅ Merged **Merged:** 1/24/2025 **Merged by:** [@stonith404](https://github.com/stonith404) **Base:** `main` ← **Head:** `fix/host-cookies` --- ### 📝 Commits (2) - [`d34f8b4`](https://github.com/pocket-id/pocket-id/commit/d34f8b4f97c5f5954317a7126753e0d100699a59) add `__HOST` prefix to cookies - [`4e568e5`](https://github.com/pocket-id/pocket-id/commit/4e568e500b690ff6c5ec2dcc0f215ce3f690410f) only use `__Host` prefix if https is enabled ### 📊 Changes **21 files changed** (+80 additions, -46 deletions) <details> <summary>View changed files</summary> 📝 `backend/internal/controller/user_controller.go` (+10 -2) 📝 `backend/internal/controller/webauthn_controller.go` (+11 -7) 📝 `backend/internal/middleware/jwt_auth.go` (+2 -1) ➕ `backend/internal/utils/cookie/add_cookie.go` (+13 -0) ➕ `backend/internal/utils/cookie/cookie_names.go` (+16 -0) ➖ `backend/internal/utils/cookie_util.go` (+0 -12) 📝 `frontend/src/hooks.server.ts` (+2 -1) ➕ `frontend/src/lib/constants.ts` (+2 -0) 📝 `frontend/src/routes/+layout.server.ts` (+3 -2) 📝 `frontend/src/routes/authorize/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/account/+page.server.ts` (+3 -2) 📝 `frontend/src/routes/settings/admin/application-configuration/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/admin/oidc-clients/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/admin/oidc-clients/[id]/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/admin/user-groups/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/admin/user-groups/[id]/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/admin/users/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/admin/users/[id]/+page.server.ts` (+2 -1) 📝 `frontend/src/routes/settings/audit-log/+page.server.ts` (+2 -1) 📝 `reverse-proxy/Caddyfile` (+0 -5) _...and 1 more files_ </details> ### 📄 Description Fixes #171. Without the `__HOST` prefix another subdomain could write the "access_token" cookie which results in a redirection loop. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2025-10-09 17:00:04 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#935
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?