ticket #83 attempt 1

devplacepy/routers/auth/login.py

@@ -11,7 +11,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -103,7 +102,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,7 +10,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -101,7 +100,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/static/js/ModalManager.js

@@ -29,7 +29,6 @@ export class ModalManager {
                 const modal = document.getElementById(modalId);
                 if (modal) {
                     modal.classList.add("visible");
-                    window.history.pushState({__overlay: true}, "");
                 }
             });
         });
@@ -38,13 +37,11 @@ export class ModalManager {
             modal.addEventListener("click", (e) => {
                 if (e.target === modal) {
                     modal.classList.remove("visible");
-                    window.history.back();
                 }
             });
             modal.querySelectorAll(".modal-close").forEach((closeBtn) => {
                 closeBtn.addEventListener("click", () => {
                     modal.classList.remove("visible");
-                    window.history.back();
                 });
             });
             this.enhanceModal(modal);
@@ -53,14 +50,6 @@ export class ModalManager {
         document.addEventListener("keydown", (e) => {
             if (e.key !== "Escape") return;
             const open = [...document.querySelectorAll(".modal-overlay.visible")].pop();
-            if (open) {
-                open.classList.remove("visible");
-                window.history.back();
-            }
-        });
-
-        window.addEventListener("popstate", () => {
-            const open = document.querySelector(".modal-overlay.visible");
             if (open) open.classList.remove("visible");
         });
     }

devplacepy/static/js/components/AppContextMenu.js

@@ -51,11 +51,6 @@ export class AppContextMenu extends Component {
         document.addEventListener("keydown", (e) => {
             if (e.key === "Escape") this.close();
         });
-        window.addEventListener("popstate", () => {
-            if (this.menu.classList.contains("visible")) {
-                this.menu.classList.remove("visible");
-            }
-        });
     }
 
     render(items) {
@@ -98,7 +93,6 @@ export class AppContextMenu extends Component {
         if (!items || !items.length) return;
         this.render(items);
         this.menu.classList.add("visible");
-        window.history.pushState({__overlay: true}, "");
         const rect = this.menu.getBoundingClientRect();
         const vv = window.visualViewport;
         const safeW = vv ? vv.width : window.innerWidth;
@@ -117,7 +111,6 @@ export class AppContextMenu extends Component {
 
     close() {
         this.menu.classList.remove("visible");
-        window.history.back();
     }
 
     suppressNextClick() {

devplacepy/static/js/components/AppDialog.js

@@ -64,11 +64,6 @@ export class AppDialog extends Component {
                 this.dismiss();
             }
         });
-        window.addEventListener("popstate", () => {
-            if (this.overlay.classList.contains("visible")) {
-                this.overlay.classList.remove("visible");
-            }
-        });
         overlay.addEventListener("keydown", (e) => {
             if (e.key !== "Tab") return;
             const items = [
@@ -112,7 +107,6 @@ export class AppDialog extends Component {
 
         this.lastFocus = document.activeElement;
         this.overlay.classList.add("visible");
-        window.history.pushState({__overlay: true}, "");
         const focusTarget = mode === "prompt" ? this.input : this.confirmBtn;
         setTimeout(() => {
             focusTarget.focus();
@@ -133,7 +127,6 @@ export class AppDialog extends Component {
 
     close(value) {
         this.overlay.classList.remove("visible");
-        window.history.back();
         if (this.lastFocus && this.lastFocus.focus) this.lastFocus.focus();
         const resolve = this.resolver;
         this.resolver = null;

devplacepy/static/js/components/AppLightbox.js

@@ -54,7 +54,6 @@ export class AppLightbox extends Component {
                 this.close();
             }
         });
-        window.addEventListener("popstate", () => this._onPopstate());
         this.overlay.addEventListener("keydown", (e) => {
             if (e.key === "Tab" && this.overlay.classList.contains("visible")) {
                 e.preventDefault();
@@ -78,23 +77,15 @@ export class AppLightbox extends Component {
         this.bodyOverflow = document.body.style.overflow;
         document.body.style.overflow = "hidden";
         this.overlay.classList.add("visible");
-        window.history.pushState({__overlay: true}, "");
         setTimeout(() => this.closeBtn.focus(), 20);
     }
 
     close() {
         this.overlay.classList.remove("visible");
-        window.history.back();
         this.image.src = "";
         document.body.style.overflow = this.bodyOverflow;
         if (this.lastFocus && this.lastFocus.focus) this.lastFocus.focus();
     }
-
-    _onPopstate() {
-        if (this.overlay.classList.contains("visible")) {
-            this.overlay.classList.remove("visible");
-        }
-    }
 }
 
 customElements.define("dp-lightbox", AppLightbox);

tests/api/auth/test_login_cookie.py

@@ -0,0 +1,18 @@
+# retoor <retoor@molodetz.nl>
+
+import requests
+from tests.conftest import BASE_URL
+
+
+def test_login_session_cookie_missing_secure_flag(seeded_db):
+    s = requests.Session()
+    r = s.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=False,
+    )
+    set_cookie = r.headers.get("Set-Cookie", "")
+    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
+    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
+    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
+    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"