Added cookie policies on AddLiteCharmsWebSecurity

2026-06-14 12:50:13 +02:00
parent 9b15e296df
commit 6418d27f5a
2 changed files with 20 additions and 13 deletions
@@ -3,9 +3,6 @@ using LiteCharms.Features.Api;
 using LiteCharms.Features.Api.Configuration;
 using LiteCharms.Features.Api.Sdk;
 using LiteCharms.Features.Postgres;
-using Microsoft.AspNetCore.Hosting;
-using System.Runtime.InteropServices;
-using System.Security.Cryptography.X509Certificates;

 namespace LiteCharms.Features.Extensions;

@@ -75,39 +72,48 @@ public static class Api
            options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
        })
-        .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
+        .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
+        {
+            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.Cookie.SameSite = SameSiteMode.Lax;
+            options.Cookie.Name = "LiteCharmsApp.Session";
+        })
        .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
        {
            options.Authority = authOptions.Authority;
-
            options.ClientId = authOptions.ClientId;
            options.ClientSecret = authOptions.ClientSecret;
            options.ResponseType = "code";
-
+        
            options.SaveTokens = true;
-            options.GetClaimsFromUserInfoEndpoint = true;
-
+            options.GetClaimsFromUserInfoEndpoint = true;        
+            options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.CorrelationCookie.SameSite = SameSiteMode.None;
+        
+            options.NonceCookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.NonceCookie.SameSite = SameSiteMode.None;
+        
            options.ForwardSignOut = CookieAuthenticationDefaults.AuthenticationScheme;
-
+        
            options.Scope.Clear();
            options.Scope.Add("openid");
            options.Scope.Add("profile");
            options.Scope.Add("email");
-
+        
            options.Events = new OpenIdConnectEvents
            {
                OnRedirectToIdentityProviderForSignOut = context =>
                {
                    var idToken = context.ProtocolMessage.IdTokenHint;
-
+        
                    if (string.IsNullOrEmpty(idToken))
                    {
                        var tokens = context.Properties.GetTokens();
                        var idTokenItem = tokens.FirstOrDefault(t => string.Equals(t.Name, "id_token", StringComparison.Ordinal));
-
+        
                        if (idTokenItem != null) context.ProtocolMessage.IdTokenHint = idTokenItem.Value;
                    }
-
+        
                    return Task.CompletedTask;
                },
            };