new config allow_session_ip_change (no UI yet)
Massimo Melina committed
Sep 4, 2024 at 14:31 UTC
e7e43e0fc840e2f14a979d1924173059de2b0610
2 files changed
+3
-2
config.md
+1
@@ -121,6 +121,7 @@ Configuration can be done in several ways
121
Optionally, you can append “>” followed by a regular expression to determine a successful answer, otherwise status code will be used.
122
Multiple URLs are supported and you can specify one for each line.
123
- `auto_basic` automatically detect (based on user-agent) when the basic web inteface should be served, to support legacy browsers. Default true.
124
+- `allow_session_ip_change` should requests of the same login session be allowed from different IP addresses. Default is false, to prevent cookie stealing. You can set it `true` to always allow it, or `https` to allow only on https, where stealing the cookie is harder.
125
- `create-admin` special entry to quickly create an admin account. The value will be set as password. As soon as the account is created, this entry is removed.
126
127
#### Virtual File System (VFS)
src/middlewares.ts
+2
-2
@@ -16,6 +16,7 @@ import session from 'koa-session'
16
import { app } from './index'
17
import events from './events'
18
19
+const allowSessionIpChange = defineConfig<boolean | 'https'>('allow_session_ip_change', false)
20
const forceHttps = defineConfig('force_https', true)
21
const ignoreProxies = defineConfig('ignore_proxies', false)
22
export const sessionDuration = defineConfig('session_duration', Number(process.env.SESSION_DURATION) || DAY/1000,
@@ -48,9 +49,8 @@ export const headRequests: Koa.Middleware = async (ctx, next) => {
49
let proxyDetected: undefined | Koa.Context
50
export const someSecurity: Koa.Middleware = (ctx, next) => {
51
ctx.request.ip = normalizeIp(ctx.ip)
51
- // don't allow sessions to change ip
52
const ss = ctx.session
53
- if (ss?.username)
53
+ if (ss?.username && (!allowSessionIpChange.get() || !ctx.secure && allowSessionIpChange.get() === 'https'))
54
if (!ss.ip)
55
ss.ip = ctx.ip
56
else if (ss.ip !== ctx.ip) {