golem15/sm-user-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: opt-in golem15.user.jwt.token_cookie sets the HttpOnly session cookie on /login, /register and /activate-by-code instead of returning the token

Browse Source 
Default off, so body-token clients are unchanged. When on, the cookie carries the auth.cookie attributes via bouncer.LoadCookieConfig and the body keeps user (and message); SameSite stays Lax, with no CSRF token; personal API tokens are untouched.
This commit is contained in:
Jakub Zych
2026-10-22 23:44:44 +02:00
parent 846087db45
commit 8bdf2c7d1a
4 changed files with 290 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
config/config.yaml
View File

@@ -5,6 +5,11 @@ jwt:
blacklist_grace: 0
leeway: 0
blacklist_sweep_interval: 10m
# On: POST /login, /register (when it signs the account in) and
# /activate-by-code set the HttpOnly session cookie from auth.cookie.* and
# leave token out of the body. A POST /refresh carried by that cookie
# rewrites it either way. Keep auth.cookie.name token or auth_token.
token_cookie: false
activation:
require_activation: true
activate_mode: auto