xevion/linkpulse
1
0
Fork 0
mirror of https://github.com/Xevion/linkpulse.git synced 2025-12-06 15:15:34 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix Set-Cookie header not propagating into HTTPException, use delete_cookie helper

Browse Source
This commit is contained in:
Xevion
2024-11-10 13:24:55 -06:00
parent 1c979ed18a
commit d6d6e35e53
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
backend/linkpulse/dependencies.py
View File

@@ -72,8 +72,11 @@ class SessionDependency:
if session is None or session.is_expired(revoke=True): if session is None or session.is_expired(revoke=True):
if self.required: if self.required:
logger.debug("Session Cookie Revoked", token=session_token) logger.debug("Session Cookie Revoked", token=session_token)
response.set_cookie("session", "", max_age=0) response.delete_cookie("session")
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Unauthorized") headers = {"set-cookie": response.headers["set-cookie"]}
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED, detail="Unauthorized", headers=headers
)
return None return None
return session return session

2
backend/linkpulse/routers/auth.py
View File

@@ -126,7 +126,7 @@ async def logout(
count = Session.delete().where(Session.user == session.user).execute() count = Session.delete().where(Session.user == session.user).execute()
logger.debug("All sessions deleted", user=session.user.email, count=count, source_token=session.token) logger.debug("All sessions deleted", user=session.user.email, count=count, source_token=session.token)
response.set_cookie("session", "", max_age=0) response.delete_cookie("session", "", max_age=0)
@router.post("/api/register") @router.post("/api/register")

3
backend/linkpulse/tests/test_auth.py
View File

@@ -1,4 +1,5 @@
from datetime import datetime, timedelta from datetime import datetime, timedelta
from wsgiref import headers
import pytest import pytest
import structlog import structlog
@@ -76,6 +77,6 @@ def test_auth_logout_expired(expired_session):
# Attempt to logout # Attempt to logout
response = client.post("/api/logout") response = client.post("/api/logout")
assert response.status_code == status.HTTP_401_UNAUTHORIZED assert response.status_code == status.HTTP_401_UNAUTHORIZED
assert client.cookies.get("session") is None assert response.headers.get("set-cookie") is not None
# TODO: Ensure ?all=True doesn't do anything either # TODO: Ensure ?all=True doesn't do anything either