lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): set cookie domain for cross-subdomain OIDC flow

Browse source
This commit is contained in:
Claus Lohmar 2026-06-15 06:44:10 +00:00
parent 3b3cc7baa4
commit 2200ff657a
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/core/auth/oidc.go
View file

@ -43,11 +43,12 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
verifier := generateToken(32) verifier := generateToken(32)
challenge := pkceChallenge(verifier) challenge := pkceChallenge(verifier)
// Store state + verifier in cookies // Store state + verifier in cookies (shared across subdomains)
http.SetCookie(w, &http.Cookie{ http.SetCookie(w, &http.Cookie{
Name: "oidc_state", Name: "oidc_state",
Value: state, Value: state,
Path: "/", Path: "/",
Domain: h.config.Domain,
MaxAge: 300, MaxAge: 300,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
@ -56,6 +57,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
Name: "oidc_verifier", Name: "oidc_verifier",
Value: verifier, Value: verifier,
Path: "/", Path: "/",
Domain: h.config.Domain,
MaxAge: 300, MaxAge: 300,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
@ -132,6 +134,7 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
Name: "nextwks_session", Name: "nextwks_session",
Value: token, Value: token,
Path: "/", Path: "/",
Domain: h.config.Domain,
MaxAge: 3600, MaxAge: 3600,
HttpOnly: true, HttpOnly: true,
SameSite: http.SameSiteStrictMode, SameSite: http.SameSiteStrictMode,