CaIon
56dbaab1d4
- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with startup validation: enabling Secure requires at least one trusted HTTPS entry URL - wire common.SessionCookieSecure into the session cookie store instead of a hardcoded Secure=false - print a startup warning when Secure session cookies are disabled - document the new settings in .env.example and docker-compose files Secure stays off by default because many deployments front new-api with plain-HTTP reverse proxies, where a hardcoded Secure default would break logins entirely; enabling it safely depends on the deployment's TLS setup, so it ships as an opt-in deployment-hardening flag.
70 lines
1.9 KiB
Go
70 lines
1.9 KiB
Go
package common
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// LogWriterMu protects concurrent access to gin.DefaultWriter/gin.DefaultErrorWriter
|
|
// during log file rotation. Acquire RLock when reading/writing through the writers,
|
|
// acquire Lock when swapping writers and closing old files.
|
|
var LogWriterMu sync.RWMutex
|
|
|
|
func SysLog(s string) {
|
|
t := time.Now()
|
|
LogWriterMu.RLock()
|
|
_, _ = fmt.Fprintf(gin.DefaultWriter, "[SYS] %v | %s \n", t.Format("2006/01/02 - 15:04:05"), s)
|
|
LogWriterMu.RUnlock()
|
|
}
|
|
|
|
func SysError(s string) {
|
|
t := time.Now()
|
|
LogWriterMu.RLock()
|
|
_, _ = fmt.Fprintf(gin.DefaultErrorWriter, "[SYS] %v | %s \n", t.Format("2006/01/02 - 15:04:05"), s)
|
|
LogWriterMu.RUnlock()
|
|
}
|
|
|
|
func FatalLog(v ...any) {
|
|
t := time.Now()
|
|
LogWriterMu.RLock()
|
|
_, _ = fmt.Fprintf(gin.DefaultErrorWriter, "[FATAL] %v | %v \n", t.Format("2006/01/02 - 15:04:05"), v)
|
|
LogWriterMu.RUnlock()
|
|
os.Exit(1)
|
|
}
|
|
|
|
func LogStartupSuccess(startTime time.Time, port string) {
|
|
duration := time.Since(startTime)
|
|
durationMs := duration.Milliseconds()
|
|
|
|
// Get network IPs
|
|
networkIps := GetNetworkIps()
|
|
|
|
LogWriterMu.RLock()
|
|
defer LogWriterMu.RUnlock()
|
|
|
|
if SessionCookieSecure == false {
|
|
// log warning if session cookie is not secure
|
|
fmt.Fprintf(gin.DefaultWriter, "\n")
|
|
fmt.Fprintf(gin.DefaultWriter, " \033[33mWarning: Session cookie is not secure. Please set SESSION_COOKIE_SECURE=true in production.\033[0m\n")
|
|
fmt.Fprintf(gin.DefaultWriter, "\n")
|
|
}
|
|
|
|
fmt.Fprintf(gin.DefaultWriter, "\n")
|
|
fmt.Fprintf(gin.DefaultWriter, " \033[32m%s %s\033[0m ready in %d ms\n", SystemName, Version, durationMs)
|
|
fmt.Fprintf(gin.DefaultWriter, "\n")
|
|
|
|
if !IsRunningInContainer() {
|
|
fmt.Fprintf(gin.DefaultWriter, " ➜ \033[1mLocal:\033[0m http://localhost:%s/\n", port)
|
|
}
|
|
|
|
for _, ip := range networkIps {
|
|
fmt.Fprintf(gin.DefaultWriter, " ➜ \033[1mNetwork:\033[0m http://%s:%s/\n", ip, port)
|
|
}
|
|
|
|
fmt.Fprintf(gin.DefaultWriter, "\n")
|
|
}
|