ga/buhapp-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Safari: cookie SameSite=Lax (same-origin proxy работает)

Browse Source
This commit is contained in:
ga 2026-08-21 11:04:13 +00:00
parent 8cb0a066b8
commit 2a765b5df5
1 changed files with 3 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
internal/handlers/auth.go
View File

@ -18,13 +18,9 @@ import (
const cookieName = "buhapp_at" const cookieName = "buhapp_at"
// setAuthCookie — кладём access-token в HttpOnly cookie (CORS-friendly, без preflight) // setAuthCookie — кладём access-token в HttpOnly cookie
// Same-origin через nginx /api proxy: cookie host-only, SameSite=Lax
func setAuthCookie(c *fiber.Ctx, token string, ttl time.Duration) { func setAuthCookie(c *fiber.Ctx, token string, ttl time.Duration) {
// SameSite=Lax работает только same-site (subdomain.co → api.subdomain.co)
// Cross-site нужен SameSite=None + Secure
// buhapp.mygoodservice.ru → api.buhapp.mygoodservice.ru — same-site в браузерной семантике
// Но Safari трактует cookie strictly — Lax достаточно для top-level navigation, не для fetch
// Поэтому: SameSite=None + Secure (обязательно для Safari кросс-поддомен)
c.Cookie(&fiber.Cookie{ c.Cookie(&fiber.Cookie{
Name: cookieName, Name: cookieName,
Value: token, Value: token,
@ -32,7 +28,7 @@ func setAuthCookie(c *fiber.Ctx, token string, ttl time.Duration) {
MaxAge: int(ttl.Seconds()), MaxAge: int(ttl.Seconds()),
HTTPOnly: true, HTTPOnly: true,
Secure: true, Secure: true,
SameSite: "None", SameSite: "Lax",
}) })
} }