Skip to content

Commit a8fea69

Browse files
liegeandliefliegeandlief
authored
Merge pull request #836 from govuk-one-login/BAU-fix-cookie-scoping
BAU: fix cookie domain scoping
2 parents b9c49c4 + 39ef417 commit a8fea69

12 files changed

Lines changed: 43 additions & 22 deletions

File tree

‎.github/workflows/integration-test.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ jobs:
4242
SESSIONS_SIGNER=localsessionsignerwhichmustbeatleast32chars
4343
SESSIONS_TABLE_NAME=amc-SessionStore
4444
ROOT_DOMAIN=localhost
45+
ROOT_DOMAIN_WITH_ENV=localhost
4546
AWS_REGION=eu-west-2
4647
LOCALSTACK_ENDPOINT=http://localhost:4566
4748
LOCAL_KMS_ENDPOINT=http://localhost:4567
@@ -88,8 +89,8 @@ jobs:
8889
LOCALSTACK_ENDPOINT=http://localhost:4566
8990
LOCAL_KMS_ENDPOINT=http://localhost:4567
9091
LOCALSTACK_ACCESS_KEY_ID=test
91-
LOCALSTACK_ACCESS_KEY=test
92-
ROOT_DOMAIN=localhost
92+
LOCALSTACK_ACCESS_KEY=test
93+
ROOT_DOMAIN=localhost
9394
EOF
9495
9596
- name: Configure API environment

‎solutions/app-infra/template.yaml‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,8 @@ Mappings:
8888
notificationsMaxReceiveCount: 5
8989
txmaAccountArn: ""
9090
stubsDomain: stubs.manage.dev.account.gov.uk
91-
rootDomain: dev.account.gov.uk
91+
rootDomain: account.gov.uk
92+
rootDomainWithEnv: dev.account.gov.uk
9293
build:
9394
dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables # pragma: allowlist-secret
9495
authorizeEndpointUrl: https://manage.build.account.gov.uk/authorize
@@ -122,7 +123,8 @@ Mappings:
122123
notificationsMaxReceiveCount: 5
123124
txmaAccountArn: ""
124125
stubsDomain: stubs.manage.build.account.gov.uk
125-
rootDomain: build.account.gov.uk
126+
rootDomain: account.gov.uk
127+
rootDomainWithEnv: build.account.gov.uk
126128
staging:
127129
dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables # pragma: allowlist-secret
128130
authorizeEndpointUrl: https://manage.staging.account.gov.uk/authorize
@@ -158,7 +160,8 @@ Mappings:
158160
notificationsMaxReceiveCount: 5
159161
txmaAccountArn: "arn:aws:iam::178023842775:root"
160162
stubsDomain: ""
161-
rootDomain: staging.account.gov.uk
163+
rootDomain: account.gov.uk
164+
rootDomainWithEnv: staging.account.gov.uk
162165
integration:
163166
dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceNonProductionVariables # pragma: allowlist-secret
164167
authorizeEndpointUrl: https://manage.integration.account.gov.uk/authorize
@@ -194,7 +197,8 @@ Mappings:
194197
notificationsMaxReceiveCount: 36
195198
txmaAccountArn: "arn:aws:iam::729485541398:root"
196199
stubsDomain: ""
197-
rootDomain: integration.account.gov.uk
200+
rootDomain: account.gov.uk
201+
rootDomainWithEnv: integration.account.gov.uk
198202
production:
199203
dynatraceSecretArn: arn:aws:secretsmanager:eu-west-2:216552277552:secret:DynatraceProductionVariables # pragma: allowlist-secret
200204
authorizeEndpointUrl: https://manage.account.gov.uk/authorize
@@ -231,6 +235,7 @@ Mappings:
231235
txmaAccountArn: "arn:aws:iam::451773080033:root"
232236
stubsDomain: ""
233237
rootDomain: account.gov.uk
238+
rootDomainWithEnv: account.gov.uk
234239

235240
Conditions:
236241
UseCodeSigning:
@@ -2334,6 +2339,12 @@ Resources:
23342339
SESSIONS_TABLE_NAME: !Sub ${AWS::StackName}-SessionStore
23352340
ROOT_DOMAIN:
23362341
!FindInMap [EnvironmentConfiguration, !Ref Environment, rootDomain]
2342+
ROOT_DOMAIN_WITH_ENV:
2343+
!FindInMap [
2344+
EnvironmentConfiguration,
2345+
!Ref Environment,
2346+
rootDomainWithEnv,
2347+
]
23372348
NOTIFICATIONS_QUEUE_URL: !GetAtt NotificationsQueue.QueueUrl
23382349
AUTH_CODE_TABLE_NAME: !Ref AuthCodeTable
23392350
JOURNEY_OUTCOME_TABLE_NAME: !Ref JourneyOutcomeTable

‎solutions/commons/utils/constants.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,6 @@ export const passkeyDetailsSchema = v.object({
2727
isBackedUp: v.boolean(),
2828
isResidentKey: v.boolean(),
2929
});
30+
31+
export const rootDomain = process.env["ROOT_DOMAIN"];
32+
export const rootDomainWithEnv = process.env["ROOT_DOMAIN_WITH_ENV"];

‎solutions/frontend/.env.integration-tests.sample‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ USE_LOCALSTACK=1
44
SESSIONS_SIGNER=localsessionsignerwhichmustbeatleast32chars
55
SESSIONS_TABLE_NAME=amc-SessionStore
66
ROOT_DOMAIN=localhost
7+
ROOT_DOMAIN_WITH_ENV=localhost
78
AWS_REGION=eu-west-2
89
LOCALSTACK_ENDPOINT=http://localhost:4566
910
LOCAL_KMS_ENDPOINT=http://localhost:4567

‎solutions/frontend/.env.sample‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ USE_LOCALSTACK=1
44
SESSIONS_SIGNER=localsessionsignerwhichmustbeatleast32chars
55
SESSIONS_TABLE_NAME=amc-SessionStore
66
ROOT_DOMAIN=localhost
7+
ROOT_DOMAIN_WITH_ENV=localhost
78
AWS_REGION=eu-west-2
89
LOCALSTACK_ENDPOINT=http://localhost:4566
910
LOCAL_KMS_ENDPOINT=http://localhost:4567

‎solutions/frontend/src/utils/configureI18n.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ vi.mock(import("../../../commons/utils/getEnvironment/index.js"), () => ({
88
getEnvironment: vi.fn(),
99
}));
1010

11-
vi.mock(import("./constants.js"), () => ({
12-
rootCookieDomain: "account.gov.uk",
11+
vi.mock(import("../../../commons/utils/constants.js"), () => ({
12+
rootDomain: "account.gov.uk",
1313
}));
1414

1515
// @ts-expect-error

‎solutions/frontend/src/utils/configureI18n.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import i18next from "i18next";
22
import { LanguageDetector } from "i18next-http-middleware";
33
import { getEnvironment } from "../../../commons/utils/getEnvironment/index.js";
4-
import { rootCookieDomain } from "./constants.js";
4+
import { rootDomain } from "../../../commons/utils/constants.js";
55

66
export enum Lang {
77
English = "en",
@@ -27,7 +27,7 @@ export const configureI18n = async (translations: Record<Lang, object>) => {
2727
ignoreCase: true,
2828
caches: ["cookie"],
2929
cookieSecure: getEnvironment() !== "local",
30-
cookieDomain: rootCookieDomain,
30+
cookieDomain: rootDomain,
3131
cookieSameSite: "none",
3232
},
3333
});

‎solutions/frontend/src/utils/constants.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
import type { FastifyReply } from "fastify";
22

3-
export const rootCookieDomain = process.env["ROOT_DOMAIN"];
4-
53
export const analyticsDefaults: FastifyReply["analytics"] = {
64
taxonomyLevel1: "accounts",
75
};

‎solutions/frontend/src/utils/session.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ vi.mock(import("../../../commons/utils/getEnvironment/index.js"), () => ({
88
getEnvironment: mockGetEnvironment,
99
}));
1010

11-
vi.mock(import("./constants.js"), () => ({
12-
rootCookieDomain: "test.com",
11+
vi.mock(import("../../../commons/utils/constants.js"), () => ({
12+
rootDomainWithEnv: "test.com",
1313
}));
1414

1515
vi.mock(import("./dynamoDbSessionStore.js"), () => ({

‎solutions/frontend/src/utils/session.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import { getEnvironment } from "../../../commons/utils/getEnvironment/index.js";
33
import assert from "node:assert";
44
import type { FastifyRequest } from "fastify";
55
import { DynamoDbSessionStore } from "./dynamoDbSessionStore.js";
6-
import { rootCookieDomain } from "./constants.js";
6+
import { rootDomainWithEnv } from "../../../commons/utils/constants.js";
77

88
export const destroySession = async (request: FastifyRequest) => {
99
await request.session.regenerate();
@@ -14,7 +14,7 @@ export const destroySession = async (request: FastifyRequest) => {
1414
export const getSessionOptions = async (): Promise<FastifySessionOptions> => {
1515
assert.ok(process.env["SESSIONS_SIGNER"]);
1616
assert.ok(process.env["SESSIONS_TABLE_NAME"]);
17-
assert.ok(rootCookieDomain);
17+
assert.ok(rootDomainWithEnv);
1818

1919
return {
2020
secret: process.env["SESSIONS_SIGNER"],
@@ -23,8 +23,8 @@ export const getSessionOptions = async (): Promise<FastifySessionOptions> => {
2323
secure: getEnvironment() !== "local",
2424
sameSite: "strict",
2525
httpOnly: true,
26-
// Scoped to the root cookie domain to allow it to be deleted on logout in the account management frontend
27-
domain: rootCookieDomain,
26+
// Scoped to the root (with env) cookie domain to allow it to be deleted on logout in the account management frontend
27+
domain: rootDomainWithEnv,
2828
},
2929
cookieName: "amc_sess",
3030
rolling: false,

0 commit comments

Comments
 (0)