@@ -47,14 +47,14 @@ import Servant.Docs (ToSample, samples, toSamples)
48instance ToSample AuthenticationCredits where
48instance ToSample AuthenticationCredits where
49 toSamples _ = samples $ map AuthenticationCredits [56, 103, 8]
49 toSamples _ = samples $ map AuthenticationCredits [56, 103, 8]
51-- MARK: Implementation
51-- MARK: Implementation
53−type AuthenticationHandler =
53+type AuthenticationHandler =
54− "login" :>
54+ "login" :>
55− ReqBody '[JSON] AuthenticationCredits :>
55+ ReqBody '[JSON] AuthenticationCredits :>
56 Post '[JSON] (Headers '[Header "Set-Cookie" String] UserId) :<|>
56 Post '[JSON] (Headers '[Header "Set-Cookie" String] UserId) :<|>
57− "logout" :>
57+ "logout" :>
58 PostNoContent '[JSON, PlainText, FormUrlEncoded] (Headers '[Header "Set-Cookie" String] NoContent)
58 PostNoContent '[JSON, PlainText, FormUrlEncoded] (Headers '[Header "Set-Cookie" String] NoContent)
60newtype AuthenticationCredits = AuthenticationCredits {authenticationId :: UserId}
60newtype AuthenticationCredits = AuthenticationCredits {authenticationId :: UserId}
@@ -70,21 +70,23 @@ logIn :: AuthenticationCredits -> App (Headers '[Header "Set-Cookie" String] Use
70logIn (AuthenticationCredits uId) = do
70logIn (AuthenticationCredits uId) = do
71 expire <- liftIO $ fmap (addUTCTime (1 * 24 * 60 * 60)) getCurrentTime -- one days
71 expire <- liftIO $ fmap (addUTCTime (1 * 24 * 60 * 60)) getCurrentTime -- one days
72 tId <- fmap userId . runQ err404 . getUser $ uId
72 tId <- fmap userId . runQ err404 . getUser $ uId
73− let cookie = defaultSetCookie {
73+ let cookie = defaultSetCookie {
74− setCookieName = cookieTokenKey,
74+ setCookieName = cookieTokenKey,
75− setCookieValue = C.pack $ show tId,
75+ setCookieValue = C.pack $ show tId,
76− setCookieExpires = Just expire,
76+ setCookieExpires = Just expire,
77− setCookiePath = Just "/" }
77+ setCookiePath = Just "/",
78+ setCookieHttpOnly = True,
79+ setCookieSecure = True }
78− return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) tId
80+ return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) tId
80logOut :: App (Headers '[Header "Set-Cookie" String] NoContent)
82logOut :: App (Headers '[Header "Set-Cookie" String] NoContent)
82− let cookie = defaultSetCookie {
84+ let cookie = defaultSetCookie {
83− setCookieName = cookieTokenKey,
85+ setCookieName = cookieTokenKey,
84− setCookieValue = "invalid",
86+ setCookieValue = "invalid",
85− setCookieExpires = Just (UTCTime (ModifiedJulianDay 0) 0),
87+ setCookieExpires = Just (UTCTime (ModifiedJulianDay 0) 0),
86 setCookiePath = Just "/" }
88 setCookiePath = Just "/" }
87− in return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) NoContent
89+ in return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) NoContent
89checkToken :: DBConnection -> BS.ByteString -> Handler UserId
91checkToken :: DBConnection -> BS.ByteString -> Handler UserId
90checkToken conn token = do
92checkToken conn token = do