mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2024-11-25 11:16:31 -05:00
Fix broken cookie handling due to missing proxy awareness
We enabled the `secure` flag for various cookies in previous commits.
This caused setups behind reverse proxies to drop cookies as the nodejs
instance wasn't aware of the fact that it was able to hand out secure
commits using an insecure connection (between the codimd instance and
the reverse proxy).
This patch makes express, the webserver framework we use, aware of
proxies and this way re-enabled the handing out of cookies. Not only the
cookie monster will enjoy, but also functionality like authentication
and real-time editing will return as intended.
References:
https://www.npmjs.com/package/express-session#cookiesecure
383d791a50
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This commit is contained in:
parent
d6ce60c86e
commit
8cf3b50ee9
1 changed files with 7 additions and 0 deletions
7
app.js
7
app.js
|
@ -51,6 +51,13 @@ if (config.useSSL) {
|
|||
server = require('http').createServer(app)
|
||||
}
|
||||
|
||||
// if we manage to provide HTTPS domains, but don't provide TLS ourselves
|
||||
// obviously a proxy is involded. In order to make sure express is aware of
|
||||
// this, we provide the option to trust proxies here.
|
||||
if (!config.useSSL && config.protocolUseSSL) {
|
||||
app.set('trust proxy', 1)
|
||||
}
|
||||
|
||||
// logger
|
||||
app.use(morgan('combined', {
|
||||
'stream': logger.stream
|
||||
|
|
Loading…
Reference in a new issue