botris.social/femto-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cookie configuration

Browse source
This commit is contained in:
john 2025-05-18 01:30:45 +02:00
parent b4edb6ae83
commit e3c95eb109
5 changed files with 22 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Femto.Api/Auth/CookieSettings.cs Normal file
View file

@ -0,0 +1,7 @@
namespace Femto.Api.Auth;
public class CookieSettings
{
public bool SameSite { get; set; }
public bool Secure { get; set; }
}

5
Femto.Api/Auth/SessionAuthenticationHandler.cs
View file

@ -15,7 +15,8 @@ internal class SessionAuthenticationHandler(
ILoggerFactory logger,
UrlEncoder encoder,
IAuthModule authModule,
CurrentUserContext currentUserContext
CurrentUserContext currentUserContext,
IOptions<CookieSettings> cookieOptions
) : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
{
protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
@ -38,7 +39,7 @@ internal class SessionAuthenticationHandler(
var identity = new ClaimsIdentity(claims, this.Scheme.Name);
var principal = new ClaimsPrincipal(identity);
this.Context.SetSession(result.Session);
this.Context.SetSession(result.Session, cookieOptions.Value);
currentUserContext.CurrentUser = new CurrentUser(result.UserId, result.Username);
return AuthenticateResult.Success(

8
Femto.Api/Controllers/Auth/AuthController.cs
View file

@ -1,14 +1,16 @@
using Femto.Api.Auth;
using Femto.Api.Sessions;
using Femto.Modules.Auth.Application;
using Femto.Modules.Auth.Application.Commands.Login;
using Femto.Modules.Auth.Application.Commands.Register;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Options;
namespace Femto.Api.Controllers.Auth;
[ApiController]
[Route("auth")]
public class AuthController(IAuthModule authModule) : ControllerBase
public class AuthController(IAuthModule authModule, IOptions<CookieSettings> cookieSettings) : ControllerBase
{
[HttpPost("login")]
public async Task<ActionResult<LoginResponse>> Login([FromBody] LoginRequest request)
@ -17,7 +19,7 @@ public class AuthController(IAuthModule authModule) : ControllerBase
new LoginCommand(request.Username, request.Password)
);
HttpContext.SetSession(result.Session);
HttpContext.SetSession(result.Session, cookieSettings.Value);
return new LoginResponse(result.UserId, result.Username);
}
@ -29,7 +31,7 @@ public class AuthController(IAuthModule authModule) : ControllerBase
new RegisterCommand(request.Username, request.Password)
);
HttpContext.SetSession(result.Session);
HttpContext.SetSession(result.Session, cookieSettings.Value);
return new RegisterResponse(result.UserId, result.Username);
}

3
Femto.Api/Program.cs
View file

@ -66,6 +66,9 @@ builder
options.JsonSerializerOptions.NumberHandling = JsonNumberHandling.AllowReadingFromString;
});
builder.Services.Configure<CookieSettings>(
builder.Configuration.GetSection("Cookies"));
builder
.Services.AddAuthentication("SessionAuth")
.AddScheme<AuthenticationSchemeOptions, SessionAuthenticationHandler>(

7
Femto.Api/Sessions/HttpContextSessionExtensions.cs
View file

@ -1,10 +1,11 @@
using Femto.Api.Auth;
using Femto.Modules.Auth.Application.Dto;
namespace Femto.Api.Sessions;
internal static class HttpContextSessionExtensions
{
public static void SetSession(this HttpContext httpContext, Session session)
public static void SetSession(this HttpContext httpContext, Session session, CookieSettings cookieSettings)
{
httpContext.Response.Cookies.Append(
"session",
@ -12,8 +13,8 @@ internal static class HttpContextSessionExtensions
new CookieOptions
{
HttpOnly = true,
// Secure = true,
// SameSite = SameSiteMode.Strict,
Secure = cookieSettings.Secure,
SameSite = cookieSettings.SameSite? SameSiteMode.Strict : SameSiteMode.None,
Expires = session.Expires,
}
);