oss/miniflux-v2
oss/miniflux-v2
1
0
Fork 0
mirror of https://github.com/miniflux/v2.git synced 2025-08-11 17:51:01 +00:00
Code Wiki Activity

Revert "feat(cookie): use SameSiteStrictMode when not using OAuth2/OIDC"

Browse source 
This reverts commit 135ce1d546.

People using Miniflux as PWA on Android are constantly being logged out.
This commit is contained in:
Frédéric Guillot 2025-08-05 17:10:55 -07:00
parent 0f3c04a98a
commit d3ad460c9d
1 changed files with 4 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

20
internal/http/cookie/cookie.go
View file

@ -18,26 +18,20 @@ const (
// New creates a new cookie.
func New(name, value string, isHTTPS bool, path string) *http.Cookie {
cookie := &http.Cookie{
return &http.Cookie{
Name: name,
Value: value,
Path: basePath(path),
Secure: isHTTPS,
HttpOnly: true,
Expires: time.Now().Add(time.Duration(config.Opts.CleanupRemoveSessionsDays()) * 24 * time.Hour),
SameSite: http.SameSiteStrictMode,
SameSite: http.SameSiteLaxMode,
}
// OAuth doesn't work when cookies are in strict mode.
if config.Opts.OAuth2Provider() != "" {
cookie.SameSite = http.SameSiteLaxMode
}
return cookie
}
// Expired returns an expired cookie.
func Expired(name string, isHTTPS bool, path string) *http.Cookie {
cookie := &http.Cookie{
return &http.Cookie{
Name: name,
Value: "",
Path: basePath(path),
@ -45,14 +39,8 @@ func Expired(name string, isHTTPS bool, path string) *http.Cookie {
HttpOnly: true,
MaxAge: -1,
Expires: time.Date(1970, 1, 1, 0, 0, 0, 0, time.UTC),
SameSite: http.SameSiteStrictMode,
SameSite: http.SameSiteLaxMode,
}
// OAuth doesn't work when cookies are in strict mode.
if config.Opts.OAuth2Provider() != "" {
cookie.SameSite = http.SameSiteLaxMode
}
return cookie
}
func basePath(path string) string {