Fixed for HTTP session with reverse proxies.
Ylian Saint-Hilaire committed
Apr 14, 2021 at 00:09 UTC
24cfc89522cd384472385b4e45c33a25ca93e85e
3 files changed
+4
-3
meshagent.js
+1
-1
@@ -1556,7 +1556,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1556
// Complete 2FA checking
1557
if (authCookie.a == 'checkAuth') {
1558
// TODO
1559
- console.log(authCookie);
1559
+ //console.log(authCookie);
1560
}
1561
1562
break;
views/default.handlebars
+2
-1
@@ -2032,7 +2032,8 @@
2032
QV('authKeySetupCheck', userinfo.otphkeys > 0);
2033
QV('authPushAuthDevCheck', (userinfo.otpdev > 0) && ((features2 & 2) != 0));
2034
QV('authCodesSetupCheck', userinfo.otpkeys > 0);
2035
- QV('managePushAuthDev', (features2 & 2) && (count2factoraAuths() > 0));
2035
+ //QV('managePushAuthDev', (features2 & 2) && (count2factoraAuths() > 0));
2036
+ QV('managePushAuthDev', false);
2037
mainUpdate(4 + 128 + 4096);
2038
2039
// Check if none or at least 2 factors are enabled.
webserver.js
+1
-1
@@ -5153,7 +5153,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5153
name: 'xid', // Recommended security practice to not use the default cookie name
5154
httpOnly: true,
5155
keys: [obj.args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
5156
- secure: true // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
5156
+ secure: (obj.args.tlsoffload == null) // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
5157
}
5158
if (obj.args.sessionsamesite != null) { sessionOptions.sameSite = obj.args.sessionsamesite; } else { sessionOptions.sameSite = 'strict'; }
5159
if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60 * 1000); }