🐛 (cors): Cookie with samesite=none

Access-Control-Allow-Credentials shoud be return both in OPTIONS and POST, Cookie with samesite=none
soxft · Aug 16, 2024 · 3ffe1da · 3ffe1da
1 parent bf8e45a
commit 3ffe1da
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/app/middleware/cors.go b/app/middleware/cors.go
@@ -16,11 +16,11 @@ func Cors() gin.HandlerFunc {
 		}
 
 		c.Header("Server", "busuanzi-by-xcsoft/"+config.VERSION)
+		c.Header("Access-Control-Allow-Credentials", "true")
 
 		if c.Request.Method == "OPTIONS" {
 			c.Header("Access-Control-Allow-Methods", "GET, POST, HEAD, OPTIONS")
-			c.Header("Access-Control-Allow-Headers", "x-bsz-referer, Authorization")
-			c.Header("Access-Control-Allow-Credentials", "true")
+			c.Header("Access-Control-Allow-Headers", "x-bsz-referer")
 			c.Header("Access-Control-Max-Age", "86400")
 			c.AbortWithStatus(204)
 			return

diff --git a/app/middleware/identity.go b/app/middleware/identity.go
@@ -35,6 +35,7 @@ func Identity() gin.HandlerFunc {
 
 func setBszIdentity(c *gin.Context, userIdentity string) {
 	uid := jwtutil.Generate(userIdentity)
+	c.SetSameSite(http.SameSiteNoneMode)
 	c.SetCookie("bsz_id", uid, 86400, "/", "", false, true)
 }