Skip to content

Commit 3108094

Browse files
Algorithm5838Algorithm5838
committed
fix(cookies): add SameSite=Lax to all Set-Cookie headers
1 parent 5d1bfa3 commit 3108094

2 files changed

Lines changed: 9 additions & 59 deletions

File tree

‎src/settings.rs‎

Lines changed: 5 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
use std::collections::HashMap;
44

55
// CRATES
6-
use crate::server::ResponseExt;
6+
use crate::server::{build_cookie, ResponseExt};
77
use crate::subreddit::join_until_size_limit;
88
use crate::utils::{deflate_decompress, redirect, template, Preferences};
99
use askama::Template;
@@ -80,14 +80,7 @@ pub async fn set(req: Request<Body>) -> Result<Response<Body>, String> {
8080

8181
for &name in &PREFS {
8282
match form.get(name) {
83-
Some(value) => response.insert_cookie(
84-
Cookie::build((name.to_owned(), value.clone()))
85-
.path("/")
86-
.http_only(true)
87-
.secure(true)
88-
.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
89-
.into(),
90-
),
83+
Some(value) => response.insert_cookie(build_cookie(name.to_owned(), value.clone(), OffsetDateTime::now_utc() + Duration::weeks(52))),
9184
None => response.remove_cookie(name.to_string()),
9285
};
9386
}
@@ -123,14 +116,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
123116

124117
for name in PREFS {
125118
match form.get(name) {
126-
Some(value) => response.insert_cookie(
127-
Cookie::build((name.to_owned(), value.clone()))
128-
.path("/")
129-
.http_only(true)
130-
.secure(true)
131-
.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
132-
.into(),
133-
),
119+
Some(value) => response.insert_cookie(build_cookie(name.to_owned(), value.clone(), OffsetDateTime::now_utc() + Duration::weeks(52))),
134120
None => {
135121
if remove_cookies {
136122
response.remove_cookie(name.to_string());
@@ -165,14 +151,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
165151
format!("subscriptions{subscriptions_number}")
166152
};
167153

168-
response.insert_cookie(
169-
Cookie::build((subscriptions_cookie, list))
170-
.path("/")
171-
.http_only(true)
172-
.secure(true)
173-
.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
174-
.into(),
175-
);
154+
response.insert_cookie(build_cookie(subscriptions_cookie, list, OffsetDateTime::now_utc() + Duration::weeks(52)));
176155

177156
subscriptions_number_to_delete_from += 1;
178157
}
@@ -217,14 +196,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
217196
format!("filters{filters_number}")
218197
};
219198

220-
response.insert_cookie(
221-
Cookie::build((filters_cookie, list))
222-
.path("/")
223-
.http_only(true)
224-
.secure(true)
225-
.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
226-
.into(),
227-
);
199+
response.insert_cookie(build_cookie(filters_cookie, list, OffsetDateTime::now_utc() + Duration::weeks(52)));
228200

229201
filters_number_to_delete_from += 1;
230202
}

‎src/subreddit.rs‎

Lines changed: 4 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@
33
use crate::utils::{
44
Post, Preferences, Subreddit, catch_random, error, filter_posts, format_num, format_url, info, nsfw_landing, param, redirect, rewrite_urls, setting, setting_or_default, template, to_absolute_url, val
55
};
6-
use crate::{client::json, server::RequestExt, server::ResponseExt};
6+
use crate::{client::json, server::{build_cookie, build_session_cookie, RequestExt, ResponseExt}};
77
use crate::{config, utils};
88
use askama::Template;
9-
use cookie::Cookie;
109
use htmlescape::decode_html;
1110
use hyper::{Request, Response};
1211
use crate::server::{full, Body};
@@ -216,14 +215,7 @@ pub async fn add_quarantine_exception(req: Request<Body>) -> Result<Response<Bod
216215
let subreddit = req.param("sub").ok_or("Invalid URL")?;
217216
let redir = param(&format!("?{}", req.uri().query().unwrap_or_default()), "redir").ok_or("Invalid URL")?;
218217
let mut response = redirect(&redir);
219-
response.insert_cookie(
220-
Cookie::build((&format!("allow_quaran_{}", subreddit.to_lowercase()), "true"))
221-
.path("/")
222-
.http_only(true)
223-
.secure(true)
224-
.expires(cookie::Expiration::Session)
225-
.into(),
226-
);
218+
response.insert_cookie(build_session_cookie(format!("allow_quaran_{}", subreddit.to_lowercase()), "true"));
227219
Ok(response)
228220
}
229221

@@ -387,14 +379,7 @@ pub async fn subscriptions_filters(req: Request<Body>) -> Result<Response<Body>,
387379
format!("subscriptions{subscriptions_number}")
388380
};
389381

390-
response.insert_cookie(
391-
Cookie::build((subscriptions_cookie, list))
392-
.path("/")
393-
.http_only(true)
394-
.secure(true)
395-
.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
396-
.into(),
397-
);
382+
response.insert_cookie(build_cookie(subscriptions_cookie, list, OffsetDateTime::now_utc() + Duration::weeks(52)));
398383

399384
subscriptions_number_to_delete_from += 1;
400385
}
@@ -436,14 +421,7 @@ pub async fn subscriptions_filters(req: Request<Body>) -> Result<Response<Body>,
436421
format!("filters{filters_number}")
437422
};
438423

439-
response.insert_cookie(
440-
Cookie::build((filters_cookie, list))
441-
.path("/")
442-
.http_only(true)
443-
.secure(true)
444-
.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
445-
.into(),
446-
);
424+
response.insert_cookie(build_cookie(filters_cookie, list, OffsetDateTime::now_utc() + Duration::weeks(52)));
447425

448426
filters_number_to_delete_from += 1;
449427
}

0 commit comments

Comments
 (0)