From 0908053f68526b97ebb8242887ddb5179c06099f Mon Sep 17 00:00:00 2001 From: Luna Seemann Date: Mon, 26 Jan 2026 20:32:06 +0100 Subject: [PATCH] feat: configurable session cookie key (#58) * feat: configurable session cookie key * chore: fmt --- .env.example | 2 ++ cmd/cocoon/main.go | 6 ++++++ plc/client.go | 10 +++++----- plc/types.go | 1 - server/handle_account_signin.go | 4 ++-- server/handle_account_signout.go | 2 +- server/server.go | 5 ++++- server/service_auth.go | 20 ++++++++++---------- 8 files changed, 30 insertions(+), 20 deletions(-) diff --git a/.env.example b/.env.example index 4c25e9f..d9712b7 100644 --- a/.env.example +++ b/.env.example @@ -8,3 +8,5 @@ COCOON_RELAYS=https://bsky.network COCOON_ADMIN_PASSWORD= # Generate with `openssl rand -hex 32` COCOON_SESSION_SECRET= +# Optional: Change the session cookie name (default: session) +# COCOON_SESSION_COOKIE_KEY=cocoon_session diff --git a/cmd/cocoon/main.go b/cmd/cocoon/main.go index acc96ea..f191b5a 100644 --- a/cmd/cocoon/main.go +++ b/cmd/cocoon/main.go @@ -146,6 +146,11 @@ func main() { Name: "session-secret", EnvVars: []string{"COCOON_SESSION_SECRET"}, }, + &cli.StringFlag{ + Name: "session-cookie-key", + EnvVars: []string{"COCOON_SESSION_COOKIE_KEY"}, + Value: "session", + }, &cli.StringFlag{ Name: "blockstore-variant", EnvVars: []string{"COCOON_BLOCKSTORE_VARIANT"}, @@ -215,6 +220,7 @@ var runServe = &cli.Command{ CDNUrl: cmd.String("s3-cdn-url"), }, SessionSecret: cmd.String("session-secret"), + SessionCookieKey: cmd.String("session-cookie-key"), BlockstoreVariant: server.MustReturnBlockstoreVariant(cmd.String("blockstore-variant")), FallbackProxy: cmd.String("fallback-proxy"), }) diff --git a/plc/client.go b/plc/client.go index ceb00a1..5e4283f 100644 --- a/plc/client.go +++ b/plc/client.go @@ -61,12 +61,12 @@ func (c *Client) CreateDID(sigkey *atcrypto.PrivateKeyK256, recovery string, han } op := Operation{ - Type: "plc_operation", + Type: "plc_operation", VerificationMethods: creds.VerificationMethods, - RotationKeys: creds.RotationKeys, - AlsoKnownAs: creds.AlsoKnownAs, - Services: creds.Services, - Prev: nil, + RotationKeys: creds.RotationKeys, + AlsoKnownAs: creds.AlsoKnownAs, + Services: creds.Services, + Prev: nil, } if err := c.SignOp(sigkey, &op); err != nil { diff --git a/plc/types.go b/plc/types.go index 7d2eeb5..9d905e0 100644 --- a/plc/types.go +++ b/plc/types.go @@ -8,7 +8,6 @@ import ( cbg "github.com/whyrusleeping/cbor-gen" ) - type DidCredentials struct { VerificationMethods map[string]string `json:"verificationMethods"` RotationKeys []string `json:"rotationKeys"` diff --git a/server/handle_account_signin.go b/server/handle_account_signin.go index 4bb8679..4490426 100644 --- a/server/handle_account_signin.go +++ b/server/handle_account_signin.go @@ -26,7 +26,7 @@ type OauthSigninInput struct { func (s *Server) getSessionRepoOrErr(e echo.Context) (*models.RepoActor, *sessions.Session, error) { ctx := e.Request().Context() - sess, err := session.Get("session", e) + sess, err := session.Get(s.config.SessionCookieKey, e) if err != nil { return nil, nil, err } @@ -75,7 +75,7 @@ func (s *Server) handleAccountSigninPost(e echo.Context) error { return helpers.ServerError(e, nil) } - sess, _ := session.Get("session", e) + sess, _ := session.Get(s.config.SessionCookieKey, e) req.Username = strings.ToLower(req.Username) var idtype string diff --git a/server/handle_account_signout.go b/server/handle_account_signout.go index cf3f139..48e7671 100644 --- a/server/handle_account_signout.go +++ b/server/handle_account_signout.go @@ -7,7 +7,7 @@ import ( ) func (s *Server) handleAccountSignout(e echo.Context) error { - sess, err := session.Get("session", e) + sess, err := session.Get(s.config.SessionCookieKey, e) if err != nil { return err } diff --git a/server/server.go b/server/server.go index 953e243..27abd2f 100644 --- a/server/server.go +++ b/server/server.go @@ -115,7 +115,8 @@ type Args struct { S3Config *S3Config - SessionSecret string + SessionSecret string + SessionCookieKey string BlockstoreVariant BlockstoreVariant FallbackProxy string @@ -132,6 +133,7 @@ type config struct { RequireInvite bool SmtpEmail string SmtpName string + SessionCookieKey string BlockstoreVariant BlockstoreVariant FallbackProxy string } @@ -392,6 +394,7 @@ func New(args *Args) (*Server, error) { RequireInvite: args.RequireInvite, SmtpName: args.SmtpName, SmtpEmail: args.SmtpEmail, + SessionCookieKey: args.SessionCookieKey, BlockstoreVariant: args.BlockstoreVariant, FallbackProxy: args.FallbackProxy, }, diff --git a/server/service_auth.go b/server/service_auth.go index d1709d8..6630d12 100644 --- a/server/service_auth.go +++ b/server/service_auth.go @@ -44,7 +44,7 @@ func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid parsedToken, err := jwt.ParseWithClaims(token, jwt.MapClaims{}, func(token *jwt.Token) (interface{}, error) { did := syntax.DID(token.Claims.(jwt.MapClaims)["iss"].(string)) - didDoc, err := s.passport.FetchDoc(ctx, did.String()); + didDoc, err := s.passport.FetchDoc(ctx, did.String()) if err != nil { return nil, fmt.Errorf("unable to resolve did %s: %s", did, err) } @@ -52,25 +52,25 @@ func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid verificationMethods := make([]atproto_identity.DocVerificationMethod, len(didDoc.VerificationMethods)) for i, verificationMethod := range didDoc.VerificationMethods { verificationMethods[i] = atproto_identity.DocVerificationMethod{ - ID: verificationMethod.Id, - Type: verificationMethod.Type, + ID: verificationMethod.Id, + Type: verificationMethod.Type, PublicKeyMultibase: verificationMethod.PublicKeyMultibase, - Controller: verificationMethod.Controller, + Controller: verificationMethod.Controller, } } services := make([]atproto_identity.DocService, len(didDoc.Service)) for i, service := range didDoc.Service { services[i] = atproto_identity.DocService{ - ID: service.Id, - Type: service.Type, + ID: service.Id, + Type: service.Type, ServiceEndpoint: service.ServiceEndpoint, } } parsedIdentity := atproto_identity.ParseIdentity(&identity.DIDDocument{ - DID: did, - AlsoKnownAs: didDoc.AlsoKnownAs, + DID: did, + AlsoKnownAs: didDoc.AlsoKnownAs, VerificationMethod: verificationMethods, - Service: services, + Service: services, }) key, err := parsedIdentity.PublicKey() @@ -88,4 +88,4 @@ func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid return "", fmt.Errorf("bad jwt lexicon method (\"lxm\"). must match: %s", nsid) } return claims["iss"].(string), nil -} \ No newline at end of file +} -- 2.51.2