feat(api): use unique cookie names

Closes: #1889
This commit is contained in:
Gauthier Roebroeck 2025-02-24 11:34:37 +08:00
parent 66c711e846
commit e7335faee9
3 changed files with 21 additions and 1 deletions

View file

@ -157,6 +157,7 @@ class SecurityConfiguration(
TokenBasedRememberMeServices(komgaSettingsProvider.rememberMeKey, komgaUserDetailsService).apply {
setTokenValiditySeconds(komgaSettingsProvider.rememberMeDuration.inWholeSeconds.toInt())
setAuthenticationDetailsSource(userAgentWebAuthenticationDetailsSource)
setCookieName("komga-remember-me")
},
)
}

View file

@ -17,7 +17,7 @@ import org.springframework.session.web.http.HttpSessionIdResolver
@Configuration
class SessionConfiguration {
@Bean
fun sessionCookieName() = "SESSION"
fun sessionCookieName() = "KOMGA-SESSION"
@Bean
fun sessionHeaderName() = "X-Auth-Token"

View file

@ -27,6 +27,8 @@ class SessionTest(
) {
private lateinit var user: KomgaUser
private val rememberMeCookieName = "komga-remember-me"
@BeforeAll
fun setup() {
user = KomgaUser("user@example.org", "user")
@ -56,6 +58,23 @@ class SessionTest(
}
}
@Test
fun `given remember-me parameter when hitting an endpoint then remember-me cookie is returned`() {
mockMvc
.get("/api/v2/users/me") {
with(httpBasic(user.email, user.password))
param("remember-me", "true")
}.andExpect {
header {
string(HttpHeaders.SET_COOKIE, containsString("$rememberMeCookieName="))
}
cookie {
exists(rememberMeCookieName)
httpOnly(rememberMeCookieName, true)
}
}
}
@Test
fun `given valid basic credentials when providing the auth header then session is returned in headers`() {
mockMvc