Refactor session cookie settings

Author: dmitrizagidulin

lib/create-app.js

@@ -54,21 +54,6 @@ function createApp (argv = {}) {
     app.locals.email = new EmailService(argv.email)
   }
 
-  var sessionSettings = {
-    secret: ldp.secret || uuid.v1(),
-    saveUninitialized: false,
-    resave: false,
-    rolling: true
-  }
-
-  // Cookies should set to be secure if https is on
-  if (ldp.webid || multiUser) {
-    sessionSettings.cookie = {
-      secure: true,
-      maxAge: 24 * 60 * 60 * 1000
-    }
-  }
-
   // Set X-Powered-By
   app.use(function (req, res, next) {
     res.set('X-Powered-By', 'solid-server')
@@ -84,7 +69,7 @@ function createApp (argv = {}) {
   app.use('/', capabilityDiscovery())
 
   // Use session cookies
-  app.use(session(sessionSettings))
+  app.use(session(sessionSettings(argv.webid, argv.host)))
 
   // Adding proxy
   if (ldp.proxy) {
@@ -153,3 +138,32 @@ function ensureAccountTemplate () {
 
   return accountTemplate
 }
+
+/**
+ * Returns a settings object for Express.js sessions.
+ *
+ * @param secureCookies {boolean}
+ * @param host {SolidHost}
+ *
+ * @return {Object} `express-session` settings object
+ */
+function sessionSettings (secureCookies, host) {
+  let sessionSettings = {
+    secret: uuid.v1(),
+    saveUninitialized: false,
+    resave: false,
+    rolling: true,
+    cookie: {
+      maxAge: 24 * 60 * 60 * 1000
+    }
+  }
+  // Cookies should set to be secure if https is on
+  if (secureCookies) {
+    sessionSettings.cookie.secure = true
+  }
+
+  // Determine the cookie domain
+  sessionSettings.cookie.domain = host.cookieDomain
+
+  return sessionSettings
+}

lib/models/solid-host.js

@@ -60,6 +60,23 @@ class SolidHost {
     }
     return this.parsedUri.protocol + '//' + accountName + '.' + this.host
   }
+
+  /**
+   * Returns a cookie domain, based on the current host's serverUri.
+   *
+   * @return {string|null}
+   */
+  get cookieDomain () {
+    let cookieDomain = null
+
+    if (this.hostname.split('.').length > 1) {
+      // For single-level domains like 'localhost', do not set the cookie domain
+      // See section on 'domain' attribute at https://curl.haxx.se/rfc/cookie_spec.html
+      cookieDomain = '.' + this.hostname
+    }
+
+    return cookieDomain
+  }
 }
 
 module.exports = SolidHost

lib/requests/create-account-request.js

@@ -82,7 +82,7 @@ class CreateAccountRequest {
       .then(this.sendResponse.bind(this))
       .then(userAccount => {
         // 'return' not used deliberately, no need to block and wait for email
-        if (userAccount.email) {
+        if (userAccount && userAccount.email) {
           debug('Sending Welcome email')
           accountManager.sendWelcomeEmail(userAccount)
         }
@@ -269,7 +269,6 @@ class CreateTlsAccountRequest extends CreateAccountRequest {
       res.end()
     }
 
-
     return userAccount
   }
 }

test/identity-provider.js test/account-creation.jstest/identity-provider.js renamed to test/account-creation.js

@@ -2,13 +2,11 @@ var supertest = require('supertest')
 // Helper functions for the FS
 var rm = require('./test-utils').rm
 var $rdf = require('rdflib')
-// var write = require('./test-utils').write
-// var cp = require('./test-utils').cp
 var read = require('./test-utils').read
 var ldnode = require('../index')
 var path = require('path')
 
-describe('Identity Provider', function () {
+describe('AccountManager (account creation tests)', function () {
   this.timeout(10000)
   process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
 
@@ -80,7 +78,14 @@ describe('Identity Provider', function () {
       var subdomain = supertest('https://nicola.' + host)
       subdomain.post('/api/accounts/new')
         .send('username=nicola')
-        .expect(400, done)
+        .expect(200)
+        .end((err) => {
+          if (err) return done(err)
+
+          subdomain.post('/api/accounts/cert')
+            .send('username=nicola&spkac=')
+            .expect(400, done)
+        })
     }).timeout(20000)
   })
 

test/solid-host.js

@@ -41,4 +41,22 @@ describe('SolidHost', () => {
       expect(() => { host.accountUriFor() }).to.throw(TypeError)
     })
   })
+
+  describe('cookieDomain getter', () => {
+    it('should return null for single-part domains (localhost)', () => {
+      let host = SolidHost.from({
+        serverUri: 'https://localhost:8443'
+      })
+
+      expect(host.cookieDomain).to.be.null
+    })
+
+    it('should return a cookie domain for multi-part domains', () => {
+      let host = SolidHost.from({
+        serverUri: 'https://example.com:8443'
+      })
+
+      expect(host.cookieDomain).to.equal('.example.com')
+    })
+  })
 })