Emil_Shanaty/Randify.pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(oauth): use SameSite=Lax for session cookie to survive cross-site redirect

Browse Source
This commit is contained in:
emil
2026-05-15 02:14:21 +03:00
parent b762e2eb66
commit de81e54ae1
3 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.sisyphus/run-continuation/ses_1d89ad89affe987QEXPgCGcx4S.json
+3 -4
View File
@@ -1,11 +1,10 @@
{
"sessionID": "ses_1d89ad89affe987QEXPgCGcx4S",
"updatedAt": "2026-05-14T23:04:32.000Z",
"updatedAt": "2026-05-14T23:12:10.460Z",
"sources": {
"background-task": {
"state": "active",
"reason": "1 background task(s) active",
"updatedAt": "2026-05-14T23:04:32.000Z"
"state": "idle",
"updatedAt": "2026-05-14T23:12:10.460Z"
}
}
}
src/pages/api/auth/callback/vk.ts
+3 -3
View File
@@ -108,9 +108,9 @@ export const GET: APIRoute = async ({ url, request }) => {
const headers = new Headers();
headers.set('Location', '/dm/');
headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; SameSite=Strict; Max-Age=604800; Path=/`);
headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
return new Response(null, {
status: 302,
src/pages/api/auth/callback/yandex.ts
+3 -3
View File
@@ -109,9 +109,9 @@ export const GET: APIRoute = async ({ url, request }) => {
const headers = new Headers();
headers.set('Location', '/dm/');
headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; SameSite=Strict; Max-Age=604800; Path=/`);
headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
return new Response(null, {
status: 302,