dandri/server
1
0 Fork 0
mirror of https://github.com/spacebarchat/server.git synced 2026-10-22 12:12:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Try adjusting CORS rules to make cookies work?

Browse Source
This commit is contained in:
Rory& committed 2025-12-13 20:16:42 +01:00
1 parent 6683dbac7b
commit 91cf11ac6f
3 files changed
+7 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/api/middlewares/Authentication.ts
+1 -1
View File
@@ -85,7 +85,7 @@ export async function Authentication(req: Request, res: Response, next: NextFunc
.find((x) => x.startsWith("__sb_sessid="))!
.split("=")[1];
// for some reason we need to require here, else the openapi generator fails with "route is not a function"
else res.setHeader("Set-Cookie", `__sb_sessid=${req.fingerprint = (await require("../util")).randomString(32)}; Secure; HttpOnly; SameSite=None`);
else res.setHeader("Set-Cookie", `__sb_sessid=${req.fingerprint = (await require("../util")).randomString(32)}; Secure; HttpOnly; SameSite=None; Path=/`);
if (
NO_AUTHORIZATION_ROUTES.some((x) => {
src/api/middlewares/CORS.ts
+5 -9
View File
@@ -21,20 +21,16 @@ import { NextFunction, Request, Response } from "express";
// TODO: config settings
export function CORS(req: Request, res: Response, next: NextFunction) {
res.set("Access-Control-Allow-Origin", "*");
res.set("Access-Control-Allow-Credentials", "true");
res.set("Access-Control-Allow-Headers", req.header("Access-Control-Request-Headers") || "*");
res.set("Access-Control-Allow-Methods", req.header("Access-Control-Request-Methods") || "*");
res.set("Access-Control-Allow-Origin", req.header("Origin") ?? "*");
res.set("Access-Control-Max-Age", "5"); // dont make it too long so we can change it dynamically
// TODO: use better CSP
res.set(
"Content-security-policy",
"default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';",
);
res.set(
"Access-Control-Allow-Headers",
req.header("Access-Control-Request-Headers") || "*",
);
res.set(
"Access-Control-Allow-Methods",
req.header("Access-Control-Request-Methods") || "*",
);
if (req.method === "OPTIONS") {
res.status(204).end();
src/gateway/Server.ts
+1 -1
View File
@@ -52,7 +52,7 @@ export class Server {
else {
this.server = http.createServer(function (req, res) {
if(!req.headers.cookie?.split("; ").find(x => x.startsWith("__sb_sessid="))) {
res.setHeader("Set-Cookie", `__sb_sessid=${randomString(32)}; Secure; HttpOnly; SameSite=None`);
res.setHeader("Set-Cookie", `__sb_sessid=${randomString(32)}; Secure; HttpOnly; SameSite=None; Path=/`);
}
res.writeHead(200).end("Online");