YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Dafuq Aleks, we do need to send the SSO cookie on all route not just the portal API route

Browse source
This commit is contained in:
Alexandre Aubin 2024-02-04 15:18:48 +01:00
parent 7f1dd865d7
commit 99e252107f
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/authenticators/ldap_admin.py
View file

@ -208,7 +208,7 @@ class Authenticator(BaseAuthenticator):
except Exception as e:
logger.debug(f"User logged out, but failed to properly invalidate the session : {e}")
response.delete_cookie("yunohost.admin", path="/")
response.delete_cookie("yunohost.admin", path="/yunohost/api")
def purge_expired_session_files(self):

4
src/authenticators/ldap_ynhuser.py
View file

@ -196,7 +196,7 @@ class Authenticator(BaseAuthenticator):
jwt.encode(infos, SESSION_SECRET(), algorithm="HS256"),
secure=True,
httponly=True,
path="/yunohost/portalapi",
path="/",
# Doesn't this cause issues ? May cause issue if the portal is on different subdomain than the portal API ? Will surely cause issue for development similar to CORS ?
samesite="strict" if not is_dev else None,
)
@ -252,7 +252,7 @@ class Authenticator(BaseAuthenticator):
except Exception as e:
logger.debug(f"User logged out, but failed to properly invalidate the session : {e}")
response.delete_cookie("yunohost.portal", path="/yunohost/portalapi")
response.delete_cookie("yunohost.portal", path="/")
def purge_expired_session_files(self):