Skip to content

Update max age of securecookie codecs when setting cookie store options - #309

Open
awhitefox wants to merge 1 commit into
gin-contrib:masterfrom
awhitefox:master
Open

Update max age of securecookie codecs when setting cookie store options#309
awhitefox wants to merge 1 commit into
gin-contrib:masterfrom
awhitefox:master

Conversation

@awhitefox

Copy link
Copy Markdown

This PR fixes a bug where setting cookie store options using .Options(...) does not update the MaxAge of its codecs. This leads to gorilla's securecookie cryptography not respecting the store's MaxAge and using the default value of 86400 * 30. Because of this, securecookie would accept expired cookies if store's MaxAge is lower than the default value or reject fresh cookies if it's higher.

Here is how CookieStore setup is done in gorilla/sessions (source):

func NewCookieStore(keyPairs ...[]byte) *CookieStore {
	cs := &CookieStore{
		Codecs: securecookie.CodecsFromPairs(keyPairs...),
		Options: &Options{
			Path:     "/",
			MaxAge:   86400 * 30,
			SameSite: http.SameSiteNoneMode,
			Secure:   true,
		},
	}

	cs.MaxAge(cs.Options.MaxAge)
	return cs
}

A cs.MaxAge(cs.Options.MaxAge) call is made to set MaxAge for codecs (source):

func (s *CookieStore) MaxAge(age int) {
	s.Options.MaxAge = age

	// Set the maxAge for each securecookie instance.
	for _, codec := range s.Codecs {
		if sc, ok := codec.(*securecookie.SecureCookie); ok {
			sc.MaxAge(age)
		}
	}
}

This PR adds the same call to gin's cookie store .Options(...) receiver:

func (c *store) Options(options sessions.Options) {
	c.CookieStore.Options = options.ToGorillaOptions()
	c.CookieStore.MaxAge(options.MaxAge) // Set the maxAge for securecookie codecs
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant