feat: set cookie to secure and strict

server/src/config.js

@@ -23,46 +23,58 @@ function getUrl(key) {
   return ''
 }
 
-const config = {
+function createConfig() {
-  host: get('HOST', 'localhost'),
+  const isProduction = process.env.NODE_ENV === 'production'
-  port: get('PORT', 3000),
+  const host = get('HOST', 'localhost')
-  db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'),
+  const port = Number(get('PORT', 3000))
-  secret: get('SECRET_KEY', ''),
+  const baseUrl = get('BASE_URL', `http://${host}:${port}`)
-  isProduction: process.env.NODE_ENV === 'production',
+  const url = new URL(baseUrl)
-  containerExpiry: get('EXPIRY', 1000 * 60 * 60),
+  return {
-  sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
+    host,
-  google: {
+    port,
-    clientID: get('GOOGLE_CLIENT_ID', ''),
+    baseUrl,
-    clientSecret: get('GOOGLE_CLIENT_SECRET', ''),
+    domain: url.hostname,
-  },
+    protocol: url.protocol,
-  github: {
+    backendUrl: get('BACKEND_URL', baseUrl),
-    clientID: get('GITHUB_CLIENT_ID', ''),
+    db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'),
-    clientSecret: get('GITHUB_CLIENT_SECRET', ''),
+    secret: get('SECRET_KEY', ''),
-  },
+    isProduction: process.env.NODE_ENV === 'production',
-  trustedProxies: getTrustProxies('TRUSTED_PROXIES'),
+    containerExpiry: get('EXPIRY', 1000 * 60 * 60),
-  surveyUrl: getUrl('SURVEY_URL', ''),
+    sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
-  bugReportUrl: getUrl('BUG_REPORT_URL', ''),
+    google: {
+      clientID: get('GOOGLE_CLIENT_ID', ''),
+      clientSecret: get('GOOGLE_CLIENT_SECRET', ''),
+    },
+    github: {
+      clientID: get('GITHUB_CLIENT_ID', ''),
+      clientSecret: get('GITHUB_CLIENT_SECRET', ''),
+    },
+    trustedProxies: getTrustProxies('TRUSTED_PROXIES'),
+    surveyUrl: getUrl('SURVEY_URL', ''),
+    bugReportUrl: getUrl('BUG_REPORT_URL', ''),
 
-  docker: {
+    docker: {
-    network: get('DOCKER_NETWORK', 'host'),
+      network: get('DOCKER_NETWORK', 'host'),
-    defaultImage: get('QUEST_IMAGE', 'linuxodyssey/quest-base'),
+      defaultImage: get('QUEST_IMAGE', 'linuxodyssey/quest-base'),
-    imagePrefix: get('DOCKER_PREFIX', 'linuxodyssey/quest-'),
+      imagePrefix: get('DOCKER_PREFIX', 'linuxodyssey/quest-'),
-    mountQuest: get('MOUNT_QUEST', ''),
+      mountQuest: get('MOUNT_QUEST', ''),
-    hostPwd: get('HOST_PWD', ''),
+      hostPwd: get('HOST_PWD', ''),
-  },
+    },
 
-  log: {
+    log: {
-    path: get('LOG_PATH', '../logs'),
+      path: get('LOG_PATH', '../logs'),
-  },
+    },
+    testing: {
+      enabled: !isProduction && process.env.TESTING === 'true',
+      username: get('TESTING_USERNAME', ''),
+      password: get('TESTING_PASSWORD', ''),
+    },
+  }
 }
 
-config.baseUrl = get('BASE_URL', `http://${config.host}:${config.port}`)
+const config = createConfig()
-config.backendUrl = get('BACKEND_URL', config.baseUrl)
+
-config.testing = {
+console.log(config)
-  enabled: !config.isProduction && process.env.TESTING === 'true',
-  username: get('TESTING_USERNAME', ''),
-  password: get('TESTING_PASSWORD', ''),
-}
 
 export function getQuestImage(id) {
   return `${config.docker.imagePrefix}${id}`

server/src/middleware/session.js

@@ -9,9 +9,10 @@ export default session({
   saveUninitialized: false,
   rolling: true,
   cookie: {
+    domain: config.domain,
     httpOnly: true,
-    secure: false,
+    secure: config.protocol === 'https:',
-    sameSite: 'lax',
+    sameSite: 'strict',
     maxAge: config.sessionMaxAge,
   },
   store: MongoStore.create({