From 1275f5f7fb65e32a17d7d397d43d0b49ecd5cd0e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Mon, 15 Aug 2022 10:40:01 +0200
Subject: [PATCH] fix: set secure only for https

---
 backend/src/lib.rs    |  5 ++++-
 backend/src/oauth2.rs | 14 ++++++++++++--
 backend/src/users.rs  |  8 ++++++--
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/backend/src/lib.rs b/backend/src/lib.rs
index ad40b5048d..08fa995dda 100644
--- a/backend/src/lib.rs
+++ b/backend/src/lib.rs
@@ -87,7 +87,7 @@ pub async fn connect_db() -> anyhow::Result<DB> {
 }
 
 struct BaseUrl(String);
-
+struct IsSecure(bool);
 struct CloudHosted(bool);
 
 pub async fn run_server(
@@ -127,6 +127,9 @@ pub async fn run_server(
         .layer(Extension(Arc::new(CloudHosted(
             std::env::var("CLOUD_HOSTED").is_ok(),
         ))))
+        .layer(Extension(Arc::new(IsSecure(
+            base_url.starts_with("https://"),
+        ))))
         .layer(Extension(http_client))
         .layer(CookieManagerLayer::new());
     // build our application with a route
diff --git a/backend/src/oauth2.rs b/backend/src/oauth2.rs
index d52cfb1431..70aded9d4b 100644
--- a/backend/src/oauth2.rs
+++ b/backend/src/oauth2.rs
@@ -22,6 +22,7 @@ use sqlx::{Postgres, Transaction};
 use tokio::{fs::File, io::AsyncReadExt};
 use tower_cookies::{Cookie, Cookies};
 
+use crate::IsSecure;
 use crate::{
     audit::{audit_log, ActionKind},
     db::{UserDB, DB},
@@ -706,6 +707,7 @@ async fn login_callback(
     Extension(clients): Extension<Arc<AllClients>>,
     Extension(db): Extension<DB>,
     Extension(http_client): Extension<Client>,
+    Extension(is_secure): Extension<Arc<IsSecure>>,
 ) -> error::Result<String> {
     let client = (&clients
         .logins
@@ -731,7 +733,14 @@ async fn login_callback(
         if let Some((email, login_type, super_admin)) = login {
             let login_type = serde_json::json!(login_type);
             if login_type == client_name {
-                crate::users::create_session_token(&email, super_admin, &mut tx, cookies).await?;
+                crate::users::create_session_token(
+                    &email,
+                    super_admin,
+                    &mut tx,
+                    cookies,
+                    is_secure.0,
+                )
+                .await?;
             } else {
                 return Err(error::Error::BadRequest(format!(
                     "an user with the email associated to this login exists but with a different \
@@ -751,7 +760,8 @@ async fn login_callback(
             .bind(user.company)
             .execute(&mut tx)
             .await?;
-            crate::users::create_session_token(&email, false, &mut tx, cookies).await?;
+            crate::users::create_session_token(&email, false, &mut tx, cookies, is_secure.0)
+                .await?;
             audit_log(
                 &mut tx,
                 &email,
diff --git a/backend/src/users.rs b/backend/src/users.rs
index 5bd62874a5..5e24e8c782 100644
--- a/backend/src/users.rs
+++ b/backend/src/users.rs
@@ -13,6 +13,7 @@ use crate::{
     db::{UserDB, DB},
     error::{self, Error, JsonResult, Result},
     utils::{require_admin, require_super_admin, Pagination},
+    IsSecure,
 };
 use argon2::{password_hash::SaltString, Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
 use axum::{
@@ -1228,6 +1229,7 @@ async fn login(
     cookies: Cookies,
     Extension(db): Extension<DB>,
     Extension(argon2): Extension<Arc<Argon2<'_>>>,
+    Extension(is_secure): Extension<Arc<IsSecure>>,
     Json(Login { email, password }): Json<Login>,
 ) -> Result<String> {
     let mut tx = db.begin().await?;
@@ -1249,7 +1251,8 @@ async fn login(
         {
             Err(Error::BadRequest("Invalid login".to_string()))
         } else {
-            let token = create_session_token(&email, super_admin, &mut tx, cookies).await?;
+            let token =
+                create_session_token(&email, super_admin, &mut tx, cookies, is_secure.0).await?;
             tx.commit().await?;
             Ok(token)
         }
@@ -1263,6 +1266,7 @@ pub async fn create_session_token<'c>(
     super_admin: bool,
     tx: &mut sqlx::Transaction<'c, sqlx::Postgres>,
     cookies: Cookies,
+    is_secure: bool,
 ) -> Result<String> {
     let token = gen_token();
     sqlx::query!(
@@ -1278,7 +1282,7 @@ pub async fn create_session_token<'c>(
     .execute(tx)
     .await?;
     let mut cookie = Cookie::new(COOKIE_NAME, token.clone());
-    cookie.set_secure(true);
+    cookie.set_secure(is_secure);
     cookie.set_path(COOKIE_PATH);
     let mut expire: OffsetDateTime = time::OffsetDateTime::now_utc();
     expire += time::Duration::days(3);