feat(adapter-nextjs): set cookie secure: false with non-SSL domain #13841
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
HuiSF
requested review from
ukhan-amazon,
haverchuck,
cshfang and
jimblanc
as code owners
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
7a35370 to
0779333
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
6edd287 to
72693a6
Compare
AllanZhengYP
approved these changes
Oct 14, 2024
|
|
||
| // a regular expression that validates the origin string to be any valid origin, and allowing local development localhost | ||
| const originRegex = | ||
| /^(http:\/\/localhost(:\d{1,5})?)|(https?:\/\/[a-z0-9-]+(\.[a-z0-9-]+)*(:\d{1,5})?)$/; |
There was a problem hiding this comment.
Is this regex sourced from any spec? If so, it'd be better to attach the source.
jjarvisp
approved these changes
Oct 22, 2024
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
0779333 to
ccca0a9
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
72693a6 to
9c80fa4
Compare
HuiSF
commented
Dec 5, 2024
packages/adapter-nextjs/src/auth/handlers/handleSignOutRequestForPagesRouter.ts
Outdated
Show resolved
Hide resolved
jjarvisp
reviewed
Dec 5, 2024
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
ccca0a9 to
554c470
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
9c80fa4 to
24fba6f
Compare
jjarvisp
approved these changes
Dec 30, 2024
packages/adapter-nextjs/__tests__/auth/utils/isValidOrigin.test.ts
Outdated
Show resolved
Hide resolved
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
554c470 to
834215f
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
43e6b22 to
48e7052
Compare
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
834215f to
93d43cc
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
48e7052 to
6852abb
Compare
ashika112
reviewed
Jan 3, 2025
| // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| // a regular expression that validates the origin string to be any valid origin, and allowing local development localhost |
There was a problem hiding this comment.
nit: a explanation of what is expected or what standard it follows in the comment would help
ashika112
reviewed
Jan 3, 2025
| @@ -56,11 +56,12 @@ export const createTokenRemoveCookies = (keys: string[]) => | |||
|
|
|||
| export const createTokenCookiesSetOptions = ( | |||
| setCookieOptions: CookieStorage.SetCookieOptions, | |||
| overrides?: Pick<CookieStorage.SetCookieOptions, 'secure'>, | |||
There was a problem hiding this comment.
curious: why is this overrides introduced now?
There was a problem hiding this comment.
This is for setting secure: false when local dev server is detected - with server-side auth flows, all cookies beings set have attribute secure: true by default and secure attribute is not a configurable fields on the public interface for now.
ashika112
approved these changes
Jan 3, 2025
Base automatically changed from
hui/fix/adapter-nextjs/5-handler-type-def
to
feat/server-auth/main
January 3, 2025 20:12
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
f7771ce to
ce16bcd
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
secure: falsewith non-SSL domainsIssue #, if available
Description of how you validated changes
Checklist
yarn testpassesChecklist for repo maintainers
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.