aiolabs/lnbits
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix: set explicit max_age for cookies (#3133)

Browse source
This commit is contained in:
Vlad Stan 2025-04-29 11:16:37 +03:00 • committed by GitHub
parent d774c7a742
commit 2dee26b728
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
lnbits/core/views/auth_api.py
View file

@ -499,9 +499,12 @@ def _auth_success_response(
sub=username or "", usr=user_id, email=email, auth_time=int(time()) sub=username or "", usr=user_id, email=email, auth_time=int(time())
) )
access_token = create_access_token(data=payload.dict()) access_token = create_access_token(data=payload.dict())
max_age = settings.auth_token_expire_minutes * 60
response = JSONResponse({"access_token": access_token, "token_type": "bearer"}) response = JSONResponse({"access_token": access_token, "token_type": "bearer"})
response.set_cookie("cookie_access_token", access_token, httponly=True) response.set_cookie(
response.set_cookie("is_lnbits_user_authorized", "true") "cookie_access_token", access_token, httponly=True, max_age=max_age
)
response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
response.delete_cookie("is_access_token_expired") response.delete_cookie("is_access_token_expired")
return response return response
@ -521,9 +524,12 @@ def _auth_api_token_response(
def _auth_redirect_response(path: str, email: str) -> RedirectResponse: def _auth_redirect_response(path: str, email: str) -> RedirectResponse:
payload = AccessTokenPayload(sub="" or "", email=email, auth_time=int(time())) payload = AccessTokenPayload(sub="" or "", email=email, auth_time=int(time()))
access_token = create_access_token(data=payload.dict()) access_token = create_access_token(data=payload.dict())
max_age = settings.auth_token_expire_minutes * 60
response = RedirectResponse(path) response = RedirectResponse(path)
response.set_cookie("cookie_access_token", access_token, httponly=True) response.set_cookie(
response.set_cookie("is_lnbits_user_authorized", "true") "cookie_access_token", access_token, httponly=True, max_age=max_age
)
response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
response.delete_cookie("is_access_token_expired") response.delete_cookie("is_access_token_expired")
return response return response