Comments (6)
It should be a matter of using usingHeaders
instead of usingCookies
in e.g. setSession
. Does that work for you?
from akka-http-session.
I've done that and now the POST method returns a Set-Refresh-Token header. What I don't understand is why I'm still getting cookies when I've made the following change
def mySetSession(v: ExampleSession) = setSession(refreshable, usingHeaders, v)
val myRequiredSession = requiredSession(refreshable, usingHeaders)
val myInvalidateSession = invalidateSession(refreshable, usingHeaders)
When I access localhost:8080/ I get redirected to localhost:8080/site/index.html and also get the following cookie
Set-Cookie: "XSRF-TOKEN=8msbjnftu71rl48i0g7f9uis66hhue5ik91dtogap08r07us7qo0lj1fubjh7drs; Path=/"
Should I be getting cookies even though I've specified I'm using headers?
from akka-http-session.
Are you using the randomTokenCsrfProtection
directive? If you are authenticating using headers, you are not vulnerable to CSRF attacks, so you don't need it
from akka-http-session.
I was using the randomTokenCrfsProtection
directive. I also had to make the following change
mySetSession(ExampleSession(body)) {
//setNewCsrfToken(checkHeader) { ctx => ctx.complete("ok") }
ctx => ctx.complete("ok")
}
I am now receiving a Set-Authorization
and Set-Refresh-Token
headers as a response to the POST method. Am I correct to assume the session ID is returned bySet-Authorization
and the value in Set-Refresh-Token
is always returned back to the website?
from akka-http-session.
Yes. The Set-Refresh-Token
is used to implement "remember me", as described here: https://github.com/softwaremill/akka-http-session#refresh-tokens-remember-me
from akka-http-session.
Thank you
from akka-http-session.
Related Issues (20)
- requireSession breaks CORS HOT 3
- RefreshTokenStorage schedule documentation HOT 5
- Infinite loop in RefreshTokenManager HOT 3
- Question: can Cassandra be used as "session"? HOT 2
- Question Regarding unresolved dependency: com.softwaremill#akka-http-session_2.12;0.5.2: not found HOT 2
- on secret management HOT 1
- Redirect unauthenticated request HOT 1
- Session token compatibility across upgrades HOT 8
- Please support Java 9! HOT 2
- Upgrade to akka-stream 2.5 HOT 2
- RSA signing for JWT HOT 1
- Build for Scala 2.13.0 HOT 1
- JWT: Add support for `iss` and `aud` claims HOT 1
- issue refreshing token HOT 7
- Allow separate access/refresh transport
- CSRF protection can be bypassed with empty header and empty cookie HOT 1
- Upgrade to akka streams 2.6.x HOT 2
- CSRF protection can be bypassed HOT 10
- Add SameSite attribute to Cookies HOT 1
- create pekko equivalent? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from akka-http-session.