fix(session): persist store on login and pow issue, validate __Host- cookie prefix rules

Modified config/default.toml +2 −1 View config/default.toml

@@ -60,7 +60,7 @@

6060cookie_secure = false

6161cookie_same_site = "lax"

6262cookie_max_age_secs = 604800

63cookie_prefix_host = true

63cookie_prefix_host = false

6464cookie_encode_ip_and_user_agent = false

6565lifespan_secs = 604800

6666max_lifespan_secs = 2592000

@@ -148,6 +148,7 @@

148148max_blob_size = 104857600

149149git_command_timeout_secs = 300

150150git_rpc_timeout_secs = 3600

151base_url = "http://localhost:3000"

151152

152153[git.sync]

153154lock_ttl_secs = 120

Modified lib/auth/src/pow/store.rs +1 −0 View lib/auth/src/pow/store.rs

@@ -40,6 +40,7 @@

4040

4141pub fn issue(session: &Session, config: &PowConfig) -> Result<Challenge, PowError> {

4242 let key = config.mac_key.as_deref().ok_or(PowError::NotConfigured)?;

43 session.set_store(true);

4344 let mut challenge = Challenge {

4445 nonce: Uuid::now_v7().to_string(),

4546 difficulty: config.difficulty,

Modified lib/auth/src/services/login.rs +1 −0 View lib/auth/src/services/login.rs

@@ -104,6 +104,7 @@

104104 attempts_reset(self.redis(), &attempts_key).await?;

105105

106106 if user.totp_enabled {

107 session.set_store(true);

107108 let challenge = TwoFactorChallenge {

108109 uid: user.uid,

109110 expires_at: now_secs() + TWO_FA_TTL_SECS,

Modified lib/session/src/share/session.rs +1 −0 View lib/session/src/share/session.rs

@@ -15,6 +15,7 @@

1515}

1616

1717pub fn apply_login(session: &Session, user: AuthUser, passwd_version: Option<i64>) {

18 session.set_store(true);

1819 session.login_user(user);

1920 session.set(PWD_VERSION_KEY, passwd_version.unwrap_or(0));

2021}

Modified lib/session/src/config.rs +19 −1 View lib/session/src/config.rs

@@ -23,7 +23,9 @@

2323 if let Some(name) = &config.cookie_name {

2424 session = session.with_session_name(name.clone());

2525 }

26 if let Some(domain) = &config.cookie_domain {

26 if let Some(domain) = &config.cookie_domain

27 && !domain.is_empty()

28 {

2729 session = session.with_cookie_domain(domain.clone());

2830 }

2931 if let Some(path) = &config.cookie_path {

@@ -115,6 +117,22 @@

115117 .into(),

116118 );

117119 }

120 if config.cookie_prefix_host == Some(true) && !secure {

121 return Err(

122 "cookie_prefix_host = true requires cookie_secure = true: browsers reject non-Secure \

123 cookies with the __Host- prefix"

124 .into(),

125 );

126 }

127 if config.cookie_prefix_host == Some(true)

128 && config.cookie_domain.as_deref().is_some_and(|domain| !domain.is_empty())

129 {

130 return Err(

131 "cookie_prefix_host = true forbids a cookie_domain: __Host- cookies must not carry \

132 a Domain attribute"

133 .into(),

134 );

135 }

118136 if !secure {

119137 tracing::warn!(

120138 "session cookies are not marked Secure (cookie_secure is not true); enable it when \