feat: set cookie to secure and strict

server/src/config.js

@@ -23,46 +23,58 @@ function getUrl(key) {
   return ''
 }
 
-const config = {
-  host: get('HOST', 'localhost'),
-  port: get('PORT', 3000),
-  db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'),
-  secret: get('SECRET_KEY', ''),
-  isProduction: process.env.NODE_ENV === 'production',
-  containerExpiry: get('EXPIRY', 1000 * 60 * 60),
-  sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
-  google: {
-    clientID: get('GOOGLE_CLIENT_ID', ''),
-    clientSecret: get('GOOGLE_CLIENT_SECRET', ''),
-  },
-  github: {
-    clientID: get('GITHUB_CLIENT_ID', ''),
-    clientSecret: get('GITHUB_CLIENT_SECRET', ''),
-  },
-  trustedProxies: getTrustProxies('TRUSTED_PROXIES'),
-  surveyUrl: getUrl('SURVEY_URL', ''),
-  bugReportUrl: getUrl('BUG_REPORT_URL', ''),
+function createConfig() {
+  const isProduction = process.env.NODE_ENV === 'production'
+  const host = get('HOST', 'localhost')
+  const port = Number(get('PORT', 3000))
+  const baseUrl = get('BASE_URL', `http://${host}:${port}`)
+  const url = new URL(baseUrl)
+  return {
+    host,
+    port,
+    baseUrl,
+    domain: url.hostname,
+    protocol: url.protocol,
+    backendUrl: get('BACKEND_URL', baseUrl),
+    db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'),
+    secret: get('SECRET_KEY', ''),
+    isProduction: process.env.NODE_ENV === 'production',
+    containerExpiry: get('EXPIRY', 1000 * 60 * 60),
+    sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
+    google: {
+      clientID: get('GOOGLE_CLIENT_ID', ''),
+      clientSecret: get('GOOGLE_CLIENT_SECRET', ''),
+    },
+    github: {
+      clientID: get('GITHUB_CLIENT_ID', ''),
+      clientSecret: get('GITHUB_CLIENT_SECRET', ''),
+    },
+    trustedProxies: getTrustProxies('TRUSTED_PROXIES'),
+    surveyUrl: getUrl('SURVEY_URL', ''),
+    bugReportUrl: getUrl('BUG_REPORT_URL', ''),
 
-  docker: {
-    network: get('DOCKER_NETWORK', 'host'),
-    defaultImage: get('QUEST_IMAGE', 'linuxodyssey/quest-base'),
-    imagePrefix: get('DOCKER_PREFIX', 'linuxodyssey/quest-'),
-    mountQuest: get('MOUNT_QUEST', ''),
-    hostPwd: get('HOST_PWD', ''),
-  },
+    docker: {
+      network: get('DOCKER_NETWORK', 'host'),
+      defaultImage: get('QUEST_IMAGE', 'linuxodyssey/quest-base'),
+      imagePrefix: get('DOCKER_PREFIX', 'linuxodyssey/quest-'),
+      mountQuest: get('MOUNT_QUEST', ''),
+      hostPwd: get('HOST_PWD', ''),
+    },
 
-  log: {
-    path: get('LOG_PATH', '../logs'),
-  },
+    log: {
+      path: get('LOG_PATH', '../logs'),
+    },
+    testing: {
+      enabled: !isProduction && process.env.TESTING === 'true',
+      username: get('TESTING_USERNAME', ''),
+      password: get('TESTING_PASSWORD', ''),
+    },
+  }
 }
 
-config.baseUrl = get('BASE_URL', `http://${config.host}:${config.port}`)
-config.backendUrl = get('BACKEND_URL', config.baseUrl)
-config.testing = {
-  enabled: !config.isProduction && process.env.TESTING === 'true',
-  username: get('TESTING_USERNAME', ''),
-  password: get('TESTING_PASSWORD', ''),
-}
+const config = createConfig()
+
+console.log(config)
 
 export function getQuestImage(id) {
   return `${config.docker.imagePrefix}${id}`

server/src/middleware/session.js

@@ -9,9 +9,10 @@ export default session({
   saveUninitialized: false,
   rolling: true,
   cookie: {
+    domain: config.domain,
     httpOnly: true,
-    secure: false,
-    sameSite: 'lax',
+    secure: config.protocol === 'https:',
+    sameSite: 'strict',
     maxAge: config.sessionMaxAge,
   },
   store: MongoStore.create({