diff options
| author | MHSanaei <ho3ein.sanaei@gmail.com> | 2026-04-20 15:00:18 +0300 |
|---|---|---|
| committer | MHSanaei <ho3ein.sanaei@gmail.com> | 2026-04-20 15:00:18 +0300 |
| commit | c188056f64be268dda8f7c16e23f7ef9c90d014f (patch) | |
| tree | 4494f90a3447f92dbfc6751a5ddcbf34a7f9d26c /web/web.go | |
| parent | 0a424a9f160b0193bd8064b94e54aa1bfb9f0de5 (diff) | |
Centralize session options and adjust cookies
Configure session cookie options centrally in initRouter and remove per-login MaxAge handling. Deleted SetMaxAge helper and its use in the login flow; session.Options are now applied once using basePath with HttpOnly and SameSite defaults, and MaxAge is set only when the stored setting is available and >0. Also make CookieManager.setCookie treat exdays as optional (only add expires when provided) and stop using a hardcoded 150-day expiry for the lang cookie in the JS language manager.
Co-Authored-By: Alireza Ahmadi <alireza7@gmail.com>
Diffstat (limited to 'web/web.go')
| -rw-r--r-- | web/web.go | 15 |
1 files changed, 8 insertions, 7 deletions
@@ -207,14 +207,15 @@ func (s *Server) initRouter() (*gin.Engine, error) { store := cookie.NewStore(secret) // Configure default session cookie options, including expiration (MaxAge) - if sessionMaxAge, err := s.settingService.GetSessionMaxAge(); err == nil { - store.Options(sessions.Options{ - Path: "/", - MaxAge: sessionMaxAge * 60, // minutes -> seconds - HttpOnly: true, - SameSite: http.SameSiteLaxMode, - }) + sessionOptions := sessions.Options{ + Path: basePath, + HttpOnly: true, + SameSite: http.SameSiteLaxMode, } + if sessionMaxAge, err := s.settingService.GetSessionMaxAge(); err == nil && sessionMaxAge > 0 { + sessionOptions.MaxAge = sessionMaxAge * 60 // minutes -> seconds + } + store.Options(sessionOptions) engine.Use(sessions.Sessions("3x-ui", store)) engine.Use(func(c *gin.Context) { c.Set("base_path", basePath) |