Add sameSite=strict to cookies config and when deleting cookie

FrontEnd-ro · Dec 10, 2023 · 5914320 · 5914320
1 parent 42b3a1f
commit 5914320
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/server/ServerUtils.ts b/server/ServerUtils.ts
@@ -22,6 +22,7 @@ const COOKIE_CONFIG: CookieOptions = {
   maxAge: (HOUR_IN_MILLISECONDS * 24) * AUTH_EXPIRATION,
   // In production only allow this cookie with HTTPS Only 👇
   secure: appConfig.APP.env === 'production' ? true : false,
+  sameSite: "strict"
 };
 
 function setTokenCookie(token: string, res: Response, origin?: string) {

diff --git a/server/user/user.router.ts b/server/user/user.router.ts
@@ -125,8 +125,11 @@ userRouter.post('/login', async function login(
   res.json(UserModel.sanitize(user, SanitizeRole.SELF));
 })
 
-userRouter.post('/logout', (_, res: Response) => {
-  res.clearCookie('token');
+userRouter.post('/logout', (req: Request, res: Response) => {
+  res.clearCookie('token', {
+    sameSite: "strict",
+    domain: new URL(req.headers.origin).hostname
+  });
   res.status(200).send();
 });