Sienna Meridian SatterwhiteandLinus Rath
c3f60448ad
Add three environment variables for deployments with external identity providers (Keycloak, Authentik, Ory Hydra, etc.): - OAUTH_EXTRA_SCOPES: append additional scopes to the default "openid email profile" (e.g. "offline_access" for refresh tokens) - OAUTH_SCOPES: full override of the requested OAuth scopes - COOKIE_SECURE: override the Secure flag on auth cookies (useful for reverse proxy setups where the internal hop is HTTP) Without these, deploying Bulwark with an external OIDC provider that requires `offline_access` for refresh tokens is impossible — sessions die on every page refresh because no refresh token is issued. All three are backwards-compatible: unset = identical to current behavior.
15 lines
455 B
TypeScript
15 lines
455 B
TypeScript
const COOKIE_SAME_SITE = (process.env.COOKIE_SAME_SITE || 'lax') as 'lax' | 'none' | 'strict';
|
|
const COOKIE_SECURE = process.env.COOKIE_SECURE !== undefined
|
|
? process.env.COOKIE_SECURE === 'true'
|
|
: (COOKIE_SAME_SITE === 'none' || process.env.NODE_ENV === 'production');
|
|
|
|
export function getCookieOptions() {
|
|
return {
|
|
httpOnly: true,
|
|
secure: COOKIE_SECURE,
|
|
sameSite: COOKIE_SAME_SITE,
|
|
path: '/',
|
|
maxAge: 30 * 24 * 60 * 60,
|
|
};
|
|
}
|