mirror of
https://github.com/ClusterCockpit/cc-backend
synced 2026-06-17 08:57:30 +02:00
Jan Eitzinger
2b01b57495
Browser sessions are now server-side, stored in the SQLite database via scs/sqlite3store (new `sessions` table, DB migration to version 12) instead of gorilla/sessions client-side cookie storage. Only an opaque random token is kept in the cookie; session data lives server-side and survives restarts. Session middleware is wired as a hybrid to avoid buffering large responses: scs.LoadAndSave on the login/logout write paths, and a non-buffering read-only LoadSession middleware on the secured/config/frontend read paths so the large GraphQL /query responses stream unbuffered. JWT-only APIs (/api, /userapi, /api/metricstore) and static files are left unwrapped. The session cookie Secure flag is now derived from the server config (set when cc-backend terminates TLS itself); previously it was effectively never set. The SESSION_KEY env var is removed as server-side tokens need no signing secret. The dormant Bearer-JWT branch in the frontend urql client is removed; the web UI authenticates GraphQL via the session cookie. Closes #558 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Entire-Checkpoint: b51075f43cc7
12 lines
573 B
Plaintext
12 lines
573 B
Plaintext
# Base64 encoded Ed25519 keys (DO NOT USE THESE TWO IN PRODUCTION!)
|
|
# You can generate your own keypair using `go run tools/gen-keypair/main.go`
|
|
JWT_PUBLIC_KEY="kzfYrYy+TzpanWZHJ5qSdMj5uKUWgq74BWhQG6copP0="
|
|
JWT_PRIVATE_KEY="dtPC/6dWJFKZK7KZ78CvWuynylOmjBFyMsUWArwmodOTN9itjL5POlqdZkcnmpJ0yPm4pRaCrvgFaFAbpyik/Q=="
|
|
|
|
# Base64 encoded Ed25519 public key for accepting externally generated JWTs
|
|
# Keys in PEM format can be converted, see `tools/convert-pem-pubkey/Readme.md`
|
|
CROSS_LOGIN_JWT_PUBLIC_KEY=""
|
|
|
|
# Password for the ldap server (optional)
|
|
LDAP_ADMIN_PASSWORD="mashup"
|