mirror of
https://github.com/TryGhost/Ghost.git
synced 2025-02-03 23:00:14 -05:00
c756966ce9
refs https://github.com/TryGhost/Team/issues/1664 We want to have the ability for the frontend to be aware of and make use of sessions with the admin. Because these run on different domains we need to update the cookie attributes to be more lax in terms of cross domain usage.
49 lines
1.6 KiB
JavaScript
49 lines
1.6 KiB
JavaScript
const util = require('util');
|
|
const session = require('express-session');
|
|
const constants = require('@tryghost/constants');
|
|
const config = require('../../../../shared/config');
|
|
const settingsCache = require('../../../../shared/settings-cache');
|
|
const models = require('../../../models');
|
|
const urlUtils = require('../../../../shared/url-utils');
|
|
|
|
const SessionStore = require('./store');
|
|
const sessionStore = new SessionStore(models.Session);
|
|
|
|
let unoExpressSessionMiddleware;
|
|
|
|
function getExpressSessionMiddleware() {
|
|
if (!unoExpressSessionMiddleware) {
|
|
unoExpressSessionMiddleware = session({
|
|
store: sessionStore,
|
|
secret: settingsCache.get('admin_session_secret'),
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
name: 'ghost-admin-api-session',
|
|
cookie: {
|
|
maxAge: constants.SIX_MONTH_MS,
|
|
httpOnly: true,
|
|
path: urlUtils.getSubdir() + '/ghost',
|
|
sameSite: 'none',
|
|
secure: urlUtils.isSSL(config.get('url'))
|
|
}
|
|
});
|
|
}
|
|
return unoExpressSessionMiddleware;
|
|
}
|
|
|
|
module.exports.getSession = async function getSession(req, res) {
|
|
if (req.session) {
|
|
return req.session;
|
|
}
|
|
const expressSessionMiddleware = getExpressSessionMiddleware();
|
|
return new Promise((resolve, reject) => {
|
|
expressSessionMiddleware(req, res, function (err) {
|
|
if (err) {
|
|
return reject(err);
|
|
}
|
|
resolve(req.session);
|
|
});
|
|
});
|
|
};
|
|
|
|
module.exports.deleteAllSessions = util.promisify(sessionStore.clear.bind(sessionStore));
|