From 5a49eb43f23aea62b3326362ee12218198483ae4 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 15 Dec 2023 11:09:01 +0100 Subject: [PATCH] Short time-to-life for registration cookie --- .../src/main/java/myconext/api/LoginController.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/myconext-server/src/main/java/myconext/api/LoginController.java b/myconext-server/src/main/java/myconext/api/LoginController.java index d779f43c..51fba1ff 100644 --- a/myconext-server/src/main/java/myconext/api/LoginController.java +++ b/myconext-server/src/main/java/myconext/api/LoginController.java @@ -93,7 +93,8 @@ public Map config() { public void register(@RequestParam(value = "lang", required = false, defaultValue = "en") String lang, @RequestParam(value = "location", required = false) String location, HttpServletResponse response) throws IOException { - response.setHeader("Set-Cookie", REGISTER_MODUS_COOKIE_NAME + "=true; SameSite=None" + (secureCookie ? "; Secure" : "")); + String cookieValue = String.format("%s=true; Max-Age=%s; SameSite=None%s", REGISTER_MODUS_COOKIE_NAME, 60 * 10, secureCookie ? "; Secure" : ""); + response.setHeader("Set-Cookie", cookieValue); String redirectLocation = StringUtils.hasText(location) ? location : this.config.get("eduIDLoginUrl") + "&lang=" + lang; response.sendRedirect(redirectLocation); }