Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 | 1x 1x 1x 10x 10x 2x 2x 8x 8x 1x 10x 10x 10x 10x 10x 1x 6x 6x 6x | import { AUTH_COOKIE_MAX_AGE } from '@api/constants';
import type { AppContext } from '@api/types/hono';
import type { CookieOptions } from 'hono/utils/cookie';
export const AUTH_COOKIE_NAME = 'access_token';
/**
* Whether the request reached us over HTTPS.
*
* In production the server usually sits behind a TLS-terminating reverse proxy
* that the operator supplies, so `c.req.url` reports `http:` even though the
* browser is on HTTPS. Trust `X-Forwarded-Proto` when the proxy sets it, and
* fall back to the request's own protocol.
*
* This matters more now than it did when the image bundled nginx: that proxy
* is no longer ours, so the header is the only signal that the session cookie
* needs `secure`.
*/
const isSecureRequest = (c: AppContext): boolean => {
const forwardedProto = c.req.header('X-Forwarded-Proto');
if (forwardedProto) {
return forwardedProto.split(',')[0].trim().toLowerCase() === 'https';
}
return new URL(c.req.url).protocol === 'https:';
};
/**
* Cookie options for the dashboard session cookie.
*
* `login` and `logout` must agree on these: a browser only replaces a cookie
* when the name, domain and path match, so the delete has to mirror the set.
*/
export const authCookieOptions = (c: AppContext): CookieOptions => ({
path: '/',
sameSite: 'Lax',
secure: isSecureRequest(c),
httpOnly: true,
});
export const authCookieSetOptions = (c: AppContext): CookieOptions => ({
...authCookieOptions(c),
maxAge: AUTH_COOKIE_MAX_AGE,
});
|