set domain on cookie response, enforce http=True (#131)

AbandonTech · Jun 19, 2024 · 65e2d73 · 65e2d73
1 parent af3faad
commit 65e2d73
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/src/api/abandonauth/routers/password_login.py b/src/api/abandonauth/routers/password_login.py
@@ -43,5 +43,5 @@ async def login_test_user(user_data: PasswordLoginDto, res: Response) -> JwtDto:
         )
 
     access_token = generate_long_lived_jwt(str(password_account.user_id), settings.ABANDON_AUTH_DEVELOPER_APP_ID)
-    res.set_cookie("Authorization", access_token, secure=True, httponly=True)
+    res.set_cookie("Authorization", access_token, domain=settings.ABANDON_AUTH_SITE_URL, secure=True, httponly=True)
     return JwtDto(token=access_token)
diff --git a/src/api/abandonauth/routers/ui.py b/src/api/abandonauth/routers/ui.py
@@ -47,7 +47,12 @@ async def index(request: Request, code: str | None = None) -> RedirectResponse:
     if authenticated is False:
         return resp
 
-    resp.set_cookie(key="Authorization", value=token)  # pyright: ignore [reportArgumentType]
+    resp.set_cookie(
+        key="Authorization",
+        value=token,  # pyright: ignore [reportArgumentType]
+        domain=settings.ABANDON_AUTH_SITE_URL,
+        httponly=True
+    )
 
     return resp