botris.social/femto-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cookie configuration

Browse source
This commit is contained in:
john 2025-05-18 01:30:45 +02:00
parent b4edb6ae83
commit e3c95eb109
5 changed files with 22 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Femto.Api/Auth/CookieSettings.cs Normal file
View file

@ -0,0 +1,7 @@
namespace Femto.Api.Auth;
public class CookieSettings
{
public bool SameSite { get; set; }
public bool Secure { get; set; }
}

5
Femto.Api/Auth/SessionAuthenticationHandler.cs
View file

@ -15,7 +15,8 @@ internal class SessionAuthenticationHandler(
ILoggerFactory logger, ILoggerFactory logger,
UrlEncoder encoder, UrlEncoder encoder,
IAuthModule authModule, IAuthModule authModule,
CurrentUserContext currentUserContext CurrentUserContext currentUserContext,
IOptions<CookieSettings> cookieOptions
) : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder) ) : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
{ {
protected override async Task<AuthenticateResult> HandleAuthenticateAsync() protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
@ -38,7 +39,7 @@ internal class SessionAuthenticationHandler(
var identity = new ClaimsIdentity(claims, this.Scheme.Name); var identity = new ClaimsIdentity(claims, this.Scheme.Name);
var principal = new ClaimsPrincipal(identity); var principal = new ClaimsPrincipal(identity);
this.Context.SetSession(result.Session); this.Context.SetSession(result.Session, cookieOptions.Value);
currentUserContext.CurrentUser = new CurrentUser(result.UserId, result.Username); currentUserContext.CurrentUser = new CurrentUser(result.UserId, result.Username);
return AuthenticateResult.Success( return AuthenticateResult.Success(

8
Femto.Api/Controllers/Auth/AuthController.cs
View file

@ -1,14 +1,16 @@
using Femto.Api.Auth;
using Femto.Api.Sessions; using Femto.Api.Sessions;
using Femto.Modules.Auth.Application; using Femto.Modules.Auth.Application;
using Femto.Modules.Auth.Application.Commands.Login; using Femto.Modules.Auth.Application.Commands.Login;
using Femto.Modules.Auth.Application.Commands.Register; using Femto.Modules.Auth.Application.Commands.Register;
using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Options;
namespace Femto.Api.Controllers.Auth; namespace Femto.Api.Controllers.Auth;
[ApiController] [ApiController]
[Route("auth")] [Route("auth")]
public class AuthController(IAuthModule authModule) : ControllerBase public class AuthController(IAuthModule authModule, IOptions<CookieSettings> cookieSettings) : ControllerBase
{ {
[HttpPost("login")] [HttpPost("login")]
public async Task<ActionResult<LoginResponse>> Login([FromBody] LoginRequest request) public async Task<ActionResult<LoginResponse>> Login([FromBody] LoginRequest request)
@ -17,7 +19,7 @@ public class AuthController(IAuthModule authModule) : ControllerBase
new LoginCommand(request.Username, request.Password) new LoginCommand(request.Username, request.Password)
); );
HttpContext.SetSession(result.Session); HttpContext.SetSession(result.Session, cookieSettings.Value);
return new LoginResponse(result.UserId, result.Username); return new LoginResponse(result.UserId, result.Username);
} }
@ -29,7 +31,7 @@ public class AuthController(IAuthModule authModule) : ControllerBase
new RegisterCommand(request.Username, request.Password) new RegisterCommand(request.Username, request.Password)
); );
HttpContext.SetSession(result.Session); HttpContext.SetSession(result.Session, cookieSettings.Value);
return new RegisterResponse(result.UserId, result.Username); return new RegisterResponse(result.UserId, result.Username);
} }

3
Femto.Api/Program.cs
View file

@ -66,6 +66,9 @@ builder
options.JsonSerializerOptions.NumberHandling = JsonNumberHandling.AllowReadingFromString; options.JsonSerializerOptions.NumberHandling = JsonNumberHandling.AllowReadingFromString;
}); });
builder.Services.Configure<CookieSettings>(
builder.Configuration.GetSection("Cookies"));
builder builder
.Services.AddAuthentication("SessionAuth") .Services.AddAuthentication("SessionAuth")
.AddScheme<AuthenticationSchemeOptions, SessionAuthenticationHandler>( .AddScheme<AuthenticationSchemeOptions, SessionAuthenticationHandler>(

7
Femto.Api/Sessions/HttpContextSessionExtensions.cs
View file

@ -1,10 +1,11 @@
using Femto.Api.Auth;
using Femto.Modules.Auth.Application.Dto; using Femto.Modules.Auth.Application.Dto;
namespace Femto.Api.Sessions; namespace Femto.Api.Sessions;
internal static class HttpContextSessionExtensions internal static class HttpContextSessionExtensions
{ {
public static void SetSession(this HttpContext httpContext, Session session) public static void SetSession(this HttpContext httpContext, Session session, CookieSettings cookieSettings)
{ {
httpContext.Response.Cookies.Append( httpContext.Response.Cookies.Append(
"session", "session",
@ -12,8 +13,8 @@ internal static class HttpContextSessionExtensions
new CookieOptions new CookieOptions
{ {
HttpOnly = true, HttpOnly = true,
// Secure = true, Secure = cookieSettings.Secure,
// SameSite = SameSiteMode.Strict, SameSite = cookieSettings.SameSite? SameSiteMode.Strict : SameSiteMode.None,
Expires = session.Expires, Expires = session.Expires,
} }
); );