Skip to content

Commit

Permalink
Development: Disable secure cookies for local testing with dev profile (
Browse files Browse the repository at this point in the history
  • Loading branch information
DominikRemo authored Sep 14, 2023
1 parent d3075d0 commit 9acb62f
Showing 1 changed file with 5 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ public class JWTCookieService {

private static final String CYPRESS_PROFILE = "cypress";

private static final String DEVELOPMENT_PROFILE = "dev";

private final TokenProvider tokenProvider;

private final Environment environment;
Expand Down Expand Up @@ -56,12 +58,13 @@ public ResponseCookie buildLogoutCookie() {
*/
private ResponseCookie buildJWTCookie(String jwt, Duration duration) {

// TODO - Remove cypress workaround once cypress uses https and find a better solution for testing locally in Safari
Collection<String> activeProfiles = Arrays.asList(environment.getActiveProfiles());
boolean isCypress = activeProfiles.contains(CYPRESS_PROFILE);
boolean isSecure = !activeProfiles.contains(CYPRESS_PROFILE) && !activeProfiles.contains(DEVELOPMENT_PROFILE);

return ResponseCookie.from(JWT_COOKIE_NAME, jwt).httpOnly(true) // Must be httpOnly
.sameSite("Lax") // Must be Lax to allow navigation links to Artemis to work
.secure(!isCypress) // Must be secure - TODO - Remove cypress workaround once cypress uses https
.secure(isSecure) // Must be secure
.path("/") // Must be "/" to be sent in ALL request
.maxAge(duration) // Duration should match the duration of the jwt
.build(); // Build cookie
Expand Down

0 comments on commit 9acb62f

Please sign in to comment.