felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

lib/api: Set "Secure" on session cookies served over HTTPS (ref #7399) (#7907)

Browse Source 
So that it does not unnecessarily leak over clear text connections.
This commit is contained in:
Jakob Borg
2021-08-27 17:56:54 +02:00
committed by GitHub
parent c76bd7dcc4
commit 2816780b52
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/api/api_auth.go
+12
View File
@@ -108,10 +108,22 @@ func basicAuthAndSessionMiddleware(cookieName string, guiCfg config.GUIConfigura
sessionsMut.Lock() sessionsMut.Lock()
sessions[sessionid] = true sessions[sessionid] = true
sessionsMut.Unlock() sessionsMut.Unlock()
// Best effort detection of whether the connection is HTTPS --
// either directly to us, or as used by the client towards a reverse
// proxy who sends us headers.
connectionIsHTTPS := r.TLS != nil ||
strings.ToLower(r.Header.Get("x-forwarded-proto")) == "https" ||
strings.Contains(strings.ToLower(r.Header.Get("forwarded")), "proto=https")
// If the connection is HTTPS, or *should* be HTTPS, set the Secure
// bit in cookies.
useSecureCookie := connectionIsHTTPS || guiCfg.UseTLS()
http.SetCookie(w, &http.Cookie{ http.SetCookie(w, &http.Cookie{
Name: cookieName, Name: cookieName,
Value: sessionid, Value: sessionid,
MaxAge: 0, MaxAge: 0,
Secure: useSecureCookie,
}) })
emitLoginAttempt(true, username, r.RemoteAddr, evLogger) emitLoginAttempt(true, username, r.RemoteAddr, evLogger)