Jaymr/new-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

Browse Source 
* refactor(auth): replace dashboard sessions with stateless tokens

* feat(auth): harden session issuance and distributed enforcement

* fix(proxy): preserve trusted proxy compatibility defaults

* refactor: address dashboard auth review feedback

* refactor: remove classic frontend and flatten web app
This commit is contained in:
Calcium-Ion
2026-07-20 16:48:43 +08:00
committed by GitHub
parent 5a6c53d496
commit 31d70fca39
1605 changed files with 17511 additions and 147913 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/url_validator_test.go
+26
View File
@@ -193,3 +193,29 @@ func TestInitSessionCookieSettingsRejectsEmptyTrustedURLInList(t *testing.T) {
require.Error(t, InitSessionCookieSettings())
}
func TestInitSessionCookieSettingsNormalizesExactOrigins(t *testing.T) {
resetSessionCookieSettingsAfterTest(t)
t.Setenv("SESSION_COOKIE_SECURE", "true")
t.Setenv("SESSION_COOKIE_TRUSTED_URL", "https://EXAMPLE.com:443,https://admin.example.com:8443/")
require.NoError(t, InitSessionCookieSettings())
assert.Equal(t, []string{"https://example.com", "https://admin.example.com:8443"}, SessionCookieTrustedURLs)
}
func TestInitSessionCookieSettingsRejectsNonOriginURLs(t *testing.T) {
for _, trustedURL := range []string{
"https://*.example.com",
"https://user@example.com",
"https://example.com/admin",
"https://example.com?next=admin",
"https://example.com#admin",
} {
t.Run(trustedURL, func(t *testing.T) {
resetSessionCookieSettingsAfterTest(t)
t.Setenv("SESSION_COOKIE_SECURE", "true")
t.Setenv("SESSION_COOKIE_TRUSTED_URL", trustedURL)
require.Error(t, InitSessionCookieSettings())
})
}
}