fix: login with http not working after having already logged in with https #398
Massimo Melina committed
Nov 15, 2023 at 22:03 UTC
2d5386c565e0ca4a4d529dca0ce00a7eff9f6407
2 files changed
+14
-4
src/index.ts
+3
-3
@@ -10,7 +10,8 @@ import { frontEndApis } from './frontEndApis'
10
import { logMw } from './log'
11
import { pluginsMiddleware } from './plugins'
12
import { throttler } from './throttler'
13
-import { headRequests, gzipper, serveGuiAndSharedFiles, someSecurity, prepareState, paramsDecoder } from './middlewares'
13
+import { headRequests, gzipper, serveGuiAndSharedFiles, someSecurity, prepareState, paramsDecoder, sessionMiddleware
14
+} from './middlewares'
15
import './listen'
16
import './commands'
17
import { adminApis } from './adminApis'
@@ -18,7 +19,6 @@ import { defineConfig } from './config'
19
import { ok } from 'assert'
20
import _ from 'lodash'
21
import { randomId } from './misc'
21
-import session from 'koa-session'
22
import { selfCheckMiddleware } from './selfCheck'
23
import { acmeMiddleware } from './acme'
24
import './geo'
@@ -32,7 +32,7 @@ const keys = process.env.COOKIE_SIGN_KEYS?.split(',')
32
export const app = new Koa({ keys })
33
app.use(someSecurity)
34
.use(acmeMiddleware)
35
- .use(session({ key: 'hfs_$id', signed: true, rolling: true, sameSite: 'lax' }, app))
35
+ .use(sessionMiddleware)
36
.use(prepareState)
37
.use(geoFilter)
38
.use(selfCheckMiddleware)
src/middlewares.ts
+11
-1
@@ -1,7 +1,7 @@
1
// This file is part of HFS - Copyright 2021-2023, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
2
3
import compress from 'koa-compress'
4
-import Koa from 'koa'
4
+import Koa, { Middleware } from 'koa'
5
import { ADMIN_URI, API_URI, BUILD_TIMESTAMP, DEV,
6
HTTP_FORBIDDEN, HTTP_NOT_FOUND, HTTP_FOOL, HTTP_UNAUTHORIZED, HTTP_BAD_REQUEST, HTTP_METHOD_NOT_ALLOWED,
7
} from './const'
@@ -28,6 +28,8 @@ import { constants } from 'zlib'
28
import { baseUrl, getHttpsWorkingPort } from './listen'
29
import { defineConfig } from './config'
30
import { sendErrorPage } from './errorPages'
31
+import session from 'koa-session'
32
+import { app } from './index'
33
34
const forceHttps = defineConfig('force_https', true)
35
const ignoreProxies = defineConfig('ignore_proxies', false)
@@ -245,3 +247,11 @@ export const paramsDecoder: Koa.Middleware = async (ctx, next) => {
247
&& (tryJson(await stream2string(ctx.req)) || {})
248
await next()
249
}
250
+
251
+export const sessionMiddleware: Middleware = (ctx, next) =>
252
+ session({
253
+ key: 'hfs_$id' + (ctx.secure ? '' : '_http'), // once https cookie is created, http cannot
254
+ signed: true,
255
+ rolling: true,
256
+ sameSite: 'lax'
257
+ }, app)(ctx, next)
\ No newline at end of file