go-packages/iris
1
0
Fork 0
mirror of https://github.com/kataras/iris.git synced 2025-01-23 10:41:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix #1407

Browse Source 
Former-commit-id: acd8d582aab7b278ea99d0f02d79a33a8b5ee86f
This commit is contained in:
Gerasimos (Makis) Maropoulos 2019-12-19 07:10:31 +02:00
parent af90337cfd
commit 7f720eb33d
3 changed files with 41 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/PULL_REQUEST_TEMPLATE.md vendored
View File

@ -1,5 +1,5 @@
# We'd love to see more contributions # We'd love to see more contributions
Read how you can [contribute to the project](https://github.com/kataras/blob/master/CONTRIBUTING.md). Read how you can [contribute to the project](https://github.com/kataras/iris/blob/master/CONTRIBUTING.md).
> Please attach an [issue](https://github.com/kataras/iris/issues) link which your PR solves otherwise your work may be rejected. > Please attach an [issue](https://github.com/kataras/iris/issues) link which your PR solves otherwise your work may be rejected.

1
go.mod
View File

@ -29,6 +29,7 @@ require (
github.com/ryanuber/columnize v2.1.0+incompatible github.com/ryanuber/columnize v2.1.0+incompatible
github.com/schollz/closestmatch v2.1.0+incompatible github.com/schollz/closestmatch v2.1.0+incompatible
golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413
golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553
golang.org/x/text v0.3.0 golang.org/x/text v0.3.0
gopkg.in/ini.v1 v1.51.0 gopkg.in/ini.v1 v1.51.0
gopkg.in/yaml.v2 v2.2.2 gopkg.in/yaml.v2 v2.2.2

58
sessions/cookie.go
View File

@ -8,6 +8,8 @@ import (
"time" "time"
"github.com/kataras/iris/v12/context" "github.com/kataras/iris/v12/context"
"golang.org/x/net/publicsuffix"
) )
var ( var (
@ -90,32 +92,50 @@ func IsValidCookieDomain(domain string) bool {
return true return true
} }
// func formatCookieDomain(ctx context.Context, disableSubdomainPersistence bool) string {
// if disableSubdomainPersistence {
// return ""
// }
// requestDomain := ctx.Host()
// if portIdx := strings.IndexByte(requestDomain, ':'); portIdx > 0 {
// requestDomain = requestDomain[0:portIdx]
// }
// if !IsValidCookieDomain(requestDomain) {
// return ""
// }
// // RFC2109, we allow level 1 subdomains, but no further
// // if we have localhost.com , we want the localhost.com.
// // so if we have something like: mysubdomain.localhost.com we want the localhost here
// // if we have mysubsubdomain.mysubdomain.localhost.com we want the .mysubdomain.localhost.com here
// // slow things here, especially the 'replace' but this is a good and understable( I hope) way to get the be able to set cookies from subdomains & domain with 1-level limit
// if dotIdx := strings.IndexByte(requestDomain, '.'); dotIdx > 0 {
// // is mysubdomain.localhost.com || mysubsubdomain.mysubdomain.localhost.com
// if strings.IndexByte(requestDomain[dotIdx+1:], '.') > 0 {
// requestDomain = requestDomain[dotIdx+1:]
// }
// }
// // finally set the .localhost.com (for(1-level) || .mysubdomain.localhost.com (for 2-level subdomain allow)
// return "." + requestDomain // . to allow persistence
// }
func formatCookieDomain(ctx context.Context, disableSubdomainPersistence bool) string { func formatCookieDomain(ctx context.Context, disableSubdomainPersistence bool) string {
if disableSubdomainPersistence { if disableSubdomainPersistence {
return "" return ""
} }
requestDomain := ctx.Host() host := ctx.Host()
if portIdx := strings.IndexByte(requestDomain, ':'); portIdx > 0 { if portIdx := strings.IndexByte(host, ':'); portIdx > 0 {
requestDomain = requestDomain[0:portIdx] host = host[0:portIdx]
} }
if !IsValidCookieDomain(requestDomain) { domain, err := publicsuffix.EffectiveTLDPlusOne(host)
return "" if err != nil {
return "." + host
} }
// RFC2109, we allow level 1 subdomains, but no further return "." + domain
// if we have localhost.com , we want the localhost.com.
// so if we have something like: mysubdomain.localhost.com we want the localhost here
// if we have mysubsubdomain.mysubdomain.localhost.com we want the .mysubdomain.localhost.com here
// slow things here, especially the 'replace' but this is a good and understable( I hope) way to get the be able to set cookies from subdomains & domain with 1-level limit
if dotIdx := strings.IndexByte(requestDomain, '.'); dotIdx > 0 {
// is mysubdomain.localhost.com || mysubsubdomain.mysubdomain.localhost.com
if strings.IndexByte(requestDomain[dotIdx+1:], '.') > 0 {
requestDomain = requestDomain[dotIdx+1:]
}
}
// finally set the .localhost.com (for(1-level) || .mysubdomain.localhost.com (for 2-level subdomain allow)
return "." + requestDomain // . to allow persistence
} }