Set auth cookie for all allowed origins (#81)

temporalio · Jan 3, 2022 · f3c6778 · f3c6778
1 parent 4484839
commit f3c6778
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/server/routes/auth.go b/server/routes/auth.go
@@ -112,6 +112,8 @@ func authenticateCb(ctx context.Context, config *oauth2.Config, provider *oidc.P
 			Path:     "/",
 			MaxAge:   7 * 24 * int(time.Hour.Seconds()),
 			HttpOnly: true,
+			SameSite: http.SameSiteNoneMode,
+			Secure:   true,
 		}
 		sess.Values["access-token"] = &user.OAuth2Token.AccessToken
 		sess.Values["email"] = &user.IDToken.Email

diff --git a/server/server.go b/server/server.go
@@ -72,8 +72,9 @@ func NewServer(opts ...server_options.ServerOption) *Server {
 	e.Use(middleware.Logger())
 	e.Use(middleware.Recover())
 	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
-		AllowOrigins: serverOpts.Config.CORS.AllowOrigins,
-		AllowHeaders: []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept},
+		AllowOrigins:     serverOpts.Config.CORS.AllowOrigins,
+		AllowHeaders:     []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept},
+		AllowCredentials: true,
 	}))
 	e.Use(session.Middleware(sessions.NewCookieStore(
 		securecookie.GenerateRandomKey(32),