feat(adapter-nextjs): set cookie secure: false with non-SSL domain #13841
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
HuiSF
requested review from
ukhan-amazon,
haverchuck,
cshfang and
jimblanc
as code owners
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
7a35370 to
0779333
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
6edd287 to
72693a6
Compare
AllanZhengYP
approved these changes
Oct 14, 2024
|
|
||
| // a regular expression that validates the origin string to be any valid origin, and allowing local development localhost | ||
| const originRegex = | ||
| /^(http:\/\/localhost(:\d{1,5})?)|(https?:\/\/[a-z0-9-]+(\.[a-z0-9-]+)*(:\d{1,5})?)$/; |
There was a problem hiding this comment.
Is this regex sourced from any spec? If so, it'd be better to attach the source.
jjarvisp
approved these changes
Oct 22, 2024
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
0779333 to
ccca0a9
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
72693a6 to
9c80fa4
Compare
HuiSF
commented
Dec 5, 2024
packages/adapter-nextjs/src/auth/handlers/handleSignOutRequestForPagesRouter.ts
Outdated
Show resolved
Hide resolved
jjarvisp
reviewed
Dec 5, 2024
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
ccca0a9 to
554c470
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
9c80fa4 to
24fba6f
Compare
jjarvisp
approved these changes
Dec 30, 2024
packages/adapter-nextjs/__tests__/auth/utils/isValidOrigin.test.ts
Outdated
Show resolved
Hide resolved
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
554c470 to
834215f
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
43e6b22 to
48e7052
Compare
HuiSF
force-pushed
the
hui/fix/adapter-nextjs/5-handler-type-def
branch
from
834215f to
93d43cc
Compare
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
48e7052 to
6852abb
Compare
ashika112
reviewed
Jan 3, 2025
| // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| // a regular expression that validates the origin string to be any valid origin, and allowing local development localhost |
There was a problem hiding this comment.
nit: a explanation of what is expected or what standard it follows in the comment would help
ashika112
reviewed
Jan 3, 2025
| @@ -56,11 +56,12 @@ export const createTokenRemoveCookies = (keys: string[]) => | |||
|
|
|||
| export const createTokenCookiesSetOptions = ( | |||
| setCookieOptions: CookieStorage.SetCookieOptions, | |||
| overrides?: Pick<CookieStorage.SetCookieOptions, 'secure'>, | |||
There was a problem hiding this comment.
curious: why is this overrides introduced now?
There was a problem hiding this comment.
This is for setting secure: false when local dev server is detected - with server-side auth flows, all cookies beings set have attribute secure: true by default and secure attribute is not a configurable fields on the public interface for now.
ashika112
approved these changes
Jan 3, 2025
Base automatically changed from
hui/fix/adapter-nextjs/5-handler-type-def
to
feat/server-auth/main
January 3, 2025 20:12
HuiSF
force-pushed
the
hui/feat/adapter-nextjs/6-secure-for-non-ssl
branch
from
f7771ce to
ce16bcd
Compare
HuiSF
added a commit
that referenced
this pull request
Jan 6, 2025
…13841) * feat(adapter-nextjs): allow cookie secure: false with non-SSL domain * fix(adapter-nextjs): wrong naming and impl. of isSSLOrigin * chore(adapter-nextjs): resolve comment
HuiSF
added a commit
that referenced
this pull request
Jan 9, 2025
…13841) * feat(adapter-nextjs): allow cookie secure: false with non-SSL domain * fix(adapter-nextjs): wrong naming and impl. of isSSLOrigin * chore(adapter-nextjs): resolve comment
HuiSF
added a commit
that referenced
this pull request
Jan 27, 2025
…13841) * feat(adapter-nextjs): allow cookie secure: false with non-SSL domain * fix(adapter-nextjs): wrong naming and impl. of isSSLOrigin * chore(adapter-nextjs): resolve comment
HuiSF
added a commit
that referenced
this pull request
Feb 11, 2025
* feat(adapter-nextjs): add runtimeOptions.cookies to createServerRunner (#13788) * feat(aws-amplify|adapter-nextjs): add runtimeOptions.cookies to createServerRunner * chore: resolve comments * chore(adapter-nextjs): adapt the latest impl. changes * feat(adapter-nextjs): add createAuthRouteHandlers to createServerRunner (#13801) * feat(aws-amplify|adapter-nextjs): add runtimeOptions.cookies to createServerRunner * feat(adapter-nextjs): add createAuthRouteHandlers to createServerRunner * chore(adapter-nextjs): resolve comments * chore(adapter-nextjs): remove unnecessary check * feat(adapter-nextjs): server-side auth flows integrating cognito hosted UI (#13827) * chore(auth): export necessary utilities and types to support server-side auth * chore(aws-amplify): export necessary utilities to support server-side auth * feat(adapter-nextjs): server-side auth api route integrating cognito hosted ui * chore(adapter-nextjs): resolve comments * refactor(adapter-nextjs): remove redundant username fallback * feat(adapter-nextjs): add user has signed in check before initiating sign-in and sign-up (#13839) * feat(adapter-nextjs): add user has signed in check before initiating sign-in and sign-up * chore(adapter-nextjs): rename hasUserSignedIn to hasActiveUserSession * fix(adapter-nextjs): make createAuthRouteHandlers interface work in both App and Pages routers (#13840) * feat(adapter-nextjs): set cookie secure: false with non-SSL domain (#13841) * feat(adapter-nextjs): allow cookie secure: false with non-SSL domain * fix(adapter-nextjs): wrong naming and impl. of isSSLOrigin * chore(adapter-nextjs): resolve comment * refactor(adapter-nextjs): use maxAge attribute to set cookie from server to avoid clock drift (#14103) * fix(adapter-nextjs): wrong use of nullish coalescing (#14112) * refactor(adapter-nextjs): remove redundant clockDrift cookie (#14114) refactor(adapter-nextjs): remove redundant clockDrift cookie⤵️ Reasons: 1. token exachange is happening on a server - and production server rarely has wrong system time 2. when setting token cookies from server, it uses Max-Age header which is relative to the client system time. Clock drift became irrelevant 3. surely we can argue sever system time can go wrong too, however, a Next.js app API route can be executed on different servers (load balancing), there is no source of truth to generate a clock drift value * chore: enable tag publishing for server-auth (#14115) * fix(adapter-nextjs): wrong spot for checking app origin and auth config (#14119) * fix(adapter-nextjs): not await params async API in Next.js 15 (#14125) * feat(adapter-nextjs): surface redirect error and sign-in timeout error (#14116) * feat(adapter-nextjs): surface redirect error and sign-in timeout error * feat(adapter-nextjs): expose both error and errorDescription * chore(adapter-nextjs): remove unnecessary undefined fallback * chore(adapter-nextjs): add warning re: using http in production (#14134) * fix(core): generateRandomString uses Math.random() (#14132) * fix(core): generateRandomString uses Math.random() * chore(core): use better test to test actual logic * chore(aws-amplify/adapter-nextjs): remove extraneous deps (#14141) * fix(adapter-nextjs): removing only tokens and LastAuthUser cookies (#14152) * fix(adapter-nextjs): wrong cookie attributes get set sometimes (#14169) * chore: add E2E tests for next.js server auth * chore: disable tag release * fix(aws-amplify|api): internals export paths
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
secure: falsewith non-SSL domainsIssue #, if available
Description of how you validated changes
Checklist
yarn testpassesChecklist for repo maintainers
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.