This hotfix allows us to turn on and off secure cookies

ministryofjustice · Aug 15, 2024 · c3c5bc7 · c3c5bc7
1 parent c7a0f9f
commit c3c5bc7
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/src/Infrastructure/DependencyInjection.cs b/src/Infrastructure/DependencyInjection.cs
@@ -308,10 +308,17 @@ private static IServiceCollection AddAuthenticationService(this IServiceCollecti
 
         services.AddSingleton<IPasswordService, PasswordService>();
 
+        CookieSecurePolicy policy = CookieSecurePolicy.SameAsRequest;
+        if(configuration["IdentitySettings:SecureCookies"] is not null && configuration["IdentitySettings:SecureCookies"]!.Equals("True", StringComparison.CurrentCultureIgnoreCase))
+        {
+            policy = CookieSecurePolicy.Always;
+        }
+
+
         services.ConfigureApplicationCookie(options => {
             options.LoginPath = "/pages/authentication/login";
             options.Cookie.SameSite = SameSiteMode.Strict;
-            options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
+            options.Cookie.SecurePolicy = policy;
         });
 
         services

diff --git a/src/Server.UI/appsettings.json b/src/Server.UI/appsettings.json
@@ -70,7 +70,8 @@
     "RequireUpperCase": true,
     "RequireLowerCase": true,
     "DefaultLockoutTimeSpan": 30,
-    "MaxFailedAccessAttempts": 5
+    "MaxFailedAccessAttempts": 5,
+    "SecureCookies": true
   },
   "Notify": {
     "ApiKey": "",