judu/ex-ego · 57cf0d1

⑂ 57cf0d1

Use SameSite=strict for session cookieUnverified

Julien Durillon committed 2026-08-06T23:26:50+02:00 Browse files

57cf0d1 parent: df9986a

modified src/auth/extractor.rs +1 -1 Viewed

@@ -35,7 +35,7 @@ pub struct AuthRedirect;
35	35
36	36	impl IntoResponse for AuthRedirect {
37	37	fn into_response(self) -> Response {
38		- let clear = format!("{SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax");
	38	+ let clear = format!("{SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Strict");
39	39	([(SET_COOKIE, clear)], Redirect::to("/login")).into_response()
40	40	}
41	41	}

  impl IntoResponse for AuthRedirect {
      fn into_response(self) -> Response {
--        let clear = format!("{SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax");
++        let clear = format!("{SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Strict");
          ([(SET_COOKIE, clear)], Redirect::to("/login")).into_response()
      }
  }

modified src/routes/login.rs +1 -1 Viewed

@@ -61,7 +61,7 @@ pub async fn login_submit(
61	61	.path("/")
62	62	.http_only(true)
63	63	.secure(true)
64		- .same_site(SameSite::Lax)
	64	+ .same_site(SameSite::Strict)
65	65	.max_age(time::Duration::seconds(SESSION_SECONDS));
66	66	Ok((jar.add(cookie), Redirect::to("/")).into_response())
67	67	}

          .path("/")
          .http_only(true)
          .secure(true)
--        .same_site(SameSite::Lax)
++        .same_site(SameSite::Strict)
          .max_age(time::Duration::seconds(SESSION_SECONDS));
      Ok((jar.add(cookie), Redirect::to("/")).into_response())
  }