peezy-tech/jojo
2
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-05-12 22:10:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

branding!: make cookies brand independent (#10645)

Browse source 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10645
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Beowulf <beowulf@beocode.eu>
Co-committed-by: Beowulf <beowulf@beocode.eu>
This commit is contained in:
Beowulf 2026-03-19 04:34:27 +01:00 • committed by 0ko
parent d2db9b2691
commit 97a3837215
5 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/setting/security.go
View file

@ -114,7 +114,7 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
GlobalTwoFactorRequirement = NewTwoFactorRequirementType(sec.Key("GLOBAL_TWO_FACTOR_REQUIREMENT").String()) GlobalTwoFactorRequirement = NewTwoFactorRequirementType(sec.Key("GLOBAL_TWO_FACTOR_REQUIREMENT").String())
CookieRememberName = sec.Key("COOKIE_REMEMBER_NAME").MustString("gitea_incredible") CookieRememberName = sec.Key("COOKIE_REMEMBER_NAME").MustString("persistent")
ReverseProxyAuthUser = sec.Key("REVERSE_PROXY_AUTHENTICATION_USER").MustString("X-WEBAUTH-USER") ReverseProxyAuthUser = sec.Key("REVERSE_PROXY_AUTHENTICATION_USER").MustString("X-WEBAUTH-USER")
ReverseProxyAuthEmail = sec.Key("REVERSE_PROXY_AUTHENTICATION_EMAIL").MustString("X-WEBAUTH-EMAIL") ReverseProxyAuthEmail = sec.Key("REVERSE_PROXY_AUTHENTICATION_EMAIL").MustString("X-WEBAUTH-EMAIL")

4
modules/setting/session.go
View file

@ -34,7 +34,7 @@ var SessionConfig = struct {
// SameSite declares if your cookie should be restricted to a first-party or same-site context. Valid strings are "none", "lax", "strict". Default is "lax" // SameSite declares if your cookie should be restricted to a first-party or same-site context. Valid strings are "none", "lax", "strict". Default is "lax"
SameSite http.SameSite SameSite http.SameSite
}{ }{
CookieName: "i_like_gitea", CookieName: "session",
Gclifetime: 86400, Gclifetime: 86400,
Maxlifetime: 86400, Maxlifetime: 86400,
SameSite: http.SameSiteLaxMode, SameSite: http.SameSiteLaxMode,
@ -48,7 +48,7 @@ func loadSessionFrom(rootCfg ConfigProvider) {
if SessionConfig.Provider == "file" && !filepath.IsAbs(SessionConfig.ProviderConfig) { if SessionConfig.Provider == "file" && !filepath.IsAbs(SessionConfig.ProviderConfig) {
SessionConfig.ProviderConfig = path.Join(AppWorkPath, SessionConfig.ProviderConfig) SessionConfig.ProviderConfig = path.Join(AppWorkPath, SessionConfig.ProviderConfig)
} }
SessionConfig.CookieName = sec.Key("COOKIE_NAME").MustString("i_like_gitea") SessionConfig.CookieName = sec.Key("COOKIE_NAME").MustString("session")
SessionConfig.CookiePath = AppSubURL SessionConfig.CookiePath = AppSubURL
if SessionConfig.CookiePath == "" { if SessionConfig.CookiePath == "" {
SessionConfig.CookiePath = "/" SessionConfig.CookiePath = "/"

1
release-notes/10645.md Normal file
View file

@ -0,0 +1 @@
Make cookie names brand independent.<br>Attention: All users need to re-login, if you haven't manually set a cookie name in the settings. This can be prevented by changing the [remember me cookie](https://forgejo.org/docs/latest/admin/config-cheat-sheet/#security-security:~:text=COOKIE_REMEMBER_NAME) back to `gitea_incredible`

2
services/context/base_test.go
View file

@ -34,7 +34,7 @@ func TestRedirect(t *testing.T) {
resp.Header().Add("Set-Cookie", (&http.Cookie{Name: setting.SessionConfig.CookieName, Value: "dummy"}).String()) resp.Header().Add("Set-Cookie", (&http.Cookie{Name: setting.SessionConfig.CookieName, Value: "dummy"}).String())
b.Redirect(c.url) b.Redirect(c.url)
cleanup() cleanup()
has := resp.Header().Get("Set-Cookie") == "i_like_gitea=dummy" has := resp.Header().Get("Set-Cookie") == "session=dummy"
assert.Equal(t, c.keep, has, "url = %q", c.url) assert.Equal(t, c.keep, has, "url = %q", c.url)
assert.Equal(t, http.StatusSeeOther, resp.Code) assert.Equal(t, http.StatusSeeOther, resp.Code)
} }

2
services/context/context_cookie.go
View file

@ -14,7 +14,7 @@ import (
"forgejo.org/modules/web/middleware" "forgejo.org/modules/web/middleware"
) )
const CookieNameFlash = "gitea_flash" const CookieNameFlash = "flash"
func removeSessionCookieHeader(w http.ResponseWriter) { func removeSessionCookieHeader(w http.ResponseWriter) {
cookies := w.Header()["Set-Cookie"] cookies := w.Header()["Set-Cookie"]