diff options
| -rw-r--r-- | README.md | 4 | ||||
| -rw-r--r-- | cmd/neko/main.go | 8 | ||||
| -rw-r--r-- | config.example | 1 | ||||
| -rw-r--r-- | config/config.go | 1 | ||||
| -rw-r--r-- | web/web.go | 6 | ||||
| -rw-r--r-- | web/web_test.go | 3 |
6 files changed, 18 insertions, 5 deletions
@@ -216,6 +216,8 @@ Usage of neko: minutes between crawling feeds -p, --password string password to access web interface + --secure-cookies + set Secure flag on cookies (requires HTTPS) -u, --update fetch feeds and store new items -v, --verbose @@ -242,6 +244,7 @@ A subset of the command line options are supported in the configuration file, wi * imageproxy * minutes * password + * secure_cookies For example -- @@ -251,6 +254,7 @@ http: 9001 imageproxy: true minutes: 90 password: VeryLongRandomStringBecauseSecurityIsFun +# secure_cookies: true # Set to true when using HTTPS in production ``` diff --git a/cmd/neko/main.go b/cmd/neko/main.go index 47385b1..106a22e 100644 --- a/cmd/neko/main.go +++ b/cmd/neko/main.go @@ -27,7 +27,7 @@ func main() { } func Run(args []string) error { - var help, update, verbose, proxyImages bool + var help, update, verbose, proxyImages, secureCookies bool var configFile, dbfile, newFeed, export, password string var port, minutes int @@ -63,6 +63,8 @@ func Run(args []string) error { f.BoolVar(&proxyImages, "imageproxy", false, "rewrite and proxy all image requests") f.BoolVar(&proxyImages, "i", false, "rewrite and proxy all image requests (short)") + f.BoolVar(&secureCookies, "secure-cookies", false, "set Secure flag on cookies (requires HTTPS)") + f.BoolVar(&verbose, "verbose", false, "verbose output") f.BoolVar(&verbose, "v", false, "verbose output (short)") @@ -110,6 +112,10 @@ func Run(args []string) error { config.Config.ProxyImages = proxyImages } + if secureCookies != false { + config.Config.SecureCookies = secureCookies + } + models.InitDB() if update { diff --git a/config.example b/config.example index 8aa0ed3..b302cf0 100644 --- a/config.example +++ b/config.example @@ -3,3 +3,4 @@ http: 9001 imageproxy: true minutes: 90 password: VeryLongRandomStringBecauseSecurityIsFun +# secure_cookies: true # Set to true when using HTTPS in production diff --git a/config/config.go b/config/config.go index 32e4b07..ad7ebd1 100644 --- a/config/config.go +++ b/config/config.go @@ -12,6 +12,7 @@ type Settings struct { DigestPassword string `yaml:"password"` CrawlMinutes int `yaml:"minutes"` ProxyImages bool `yaml:"imageproxy"` + SecureCookies bool `yaml:"secure_cookies"` } var Config Settings @@ -265,7 +265,7 @@ func NewRouter(cfg *config.Settings) http.Handler { // Removed default root handler for legacy UI - return SecurityHeadersMiddleware(CSRFMiddleware(mux)) + return SecurityHeadersMiddleware(CSRFMiddleware(cfg, mux)) } func Serve(cfg *config.Settings) { @@ -362,7 +362,7 @@ func generateRandomToken(n int) string { return hex.EncodeToString(b) } -func CSRFMiddleware(next http.Handler) http.Handler { +func CSRFMiddleware(cfg *config.Settings, next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { cookie, err := r.Cookie("csrf_token") var token string @@ -374,7 +374,7 @@ func CSRFMiddleware(next http.Handler) http.Handler { Path: "/", HttpOnly: false, // accessible by JS SameSite: http.SameSiteNoneMode, - Secure: false, // Set to true in production with HTTPS + Secure: cfg.SecureCookies, }) } else { token = cookie.Value diff --git a/web/web_test.go b/web/web_test.go index c6cf306..0cd2764 100644 --- a/web/web_test.go +++ b/web/web_test.go @@ -737,7 +737,8 @@ func TestGzipMiddlewareNonCompressible(t *testing.T) { } func TestCSRFMiddleware(t *testing.T) { - handler := CSRFMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + cfg := &config.Settings{SecureCookies: false} + handler := CSRFMiddleware(cfg, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })) |