49 lines
1.3 KiB
Go
49 lines
1.3 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"browser.local/platform/domain"
|
|
"browser.local/platform/dto"
|
|
)
|
|
|
|
const platformSessionCookieName = "platform_session"
|
|
|
|
func (h *coreHandlers) writeAuthSession(w http.ResponseWriter, r *http.Request, session domain.AuthSession) {
|
|
response := dto.AuthSessionFromDomain(session)
|
|
if h.enforceAuthorization && strings.TrimSpace(session.SessionID) != "" {
|
|
h.setSessionCookie(w, r, session.SessionID, session.ExpiresAt)
|
|
if r.Header.Get("X-Auth-Token-Response") != "bearer" {
|
|
response.SessionID = ""
|
|
}
|
|
}
|
|
writeJSON(w, http.StatusOK, response)
|
|
}
|
|
|
|
func (h *coreHandlers) setSessionCookie(w http.ResponseWriter, r *http.Request, token string, expiresAt time.Time) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: platformSessionCookieName,
|
|
Value: token,
|
|
Path: "/api/v1",
|
|
Expires: expiresAt,
|
|
MaxAge: int(time.Until(expiresAt).Seconds()),
|
|
HttpOnly: true,
|
|
Secure: r.TLS != nil,
|
|
SameSite: http.SameSiteStrictMode,
|
|
})
|
|
}
|
|
|
|
func (h *coreHandlers) clearSessionCookie(w http.ResponseWriter, r *http.Request) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: platformSessionCookieName,
|
|
Value: "",
|
|
Path: "/api/v1",
|
|
MaxAge: -1,
|
|
HttpOnly: true,
|
|
Secure: r.TLS != nil,
|
|
SameSite: http.SameSiteStrictMode,
|
|
})
|
|
}
|