From 2a765b5df59c580268ba8d3decdf10af76888db7 Mon Sep 17 00:00:00 2001 From: ga Date: Fri, 21 Aug 2026 11:04:13 +0000 Subject: [PATCH] =?UTF-8?q?Fix=20Safari:=20cookie=20SameSite=3DLax=20(same?= =?UTF-8?q?-origin=20proxy=20=D1=80=D0=B0=D0=B1=D0=BE=D1=82=D0=B0=D0=B5?= =?UTF-8?q?=D1=82)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/handlers/auth.go | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go index aa5fefe..90be78e 100644 --- a/internal/handlers/auth.go +++ b/internal/handlers/auth.go @@ -18,13 +18,9 @@ import ( const cookieName = "buhapp_at" -// setAuthCookie — кладём access-token в HttpOnly cookie (CORS-friendly, без preflight) +// setAuthCookie — кладём access-token в HttpOnly cookie +// Same-origin через nginx /api proxy: cookie host-only, SameSite=Lax func setAuthCookie(c *fiber.Ctx, token string, ttl time.Duration) { - // SameSite=Lax работает только same-site (subdomain.co → api.subdomain.co) - // Cross-site нужен SameSite=None + Secure - // buhapp.mygoodservice.ru → api.buhapp.mygoodservice.ru — same-site в браузерной семантике - // Но Safari трактует cookie strictly — Lax достаточно для top-level navigation, не для fetch - // Поэтому: SameSite=None + Secure (обязательно для Safari кросс-поддомен) c.Cookie(&fiber.Cookie{ Name: cookieName, Value: token, @@ -32,7 +28,7 @@ func setAuthCookie(c *fiber.Ctx, token string, ttl time.Duration) { MaxAge: int(ttl.Seconds()), HTTPOnly: true, Secure: true, - SameSite: "None", + SameSite: "Lax", }) }