@@ -47,14 +47,14 @@ import Servant.Docs (ToSample, samples, toSamples)
4747
4848instance ToSample AuthenticationCredits where
4949 toSamples _ = samples $ map AuthenticationCredits [56, 103, 8]
50−
50+
5151-- MARK: Implementation
5252
53−type AuthenticationHandler =
54− "login" :>
55− ReqBody '[JSON] AuthenticationCredits :>
53+type AuthenticationHandler =
54+ "login" :>
55+ ReqBody '[JSON] AuthenticationCredits :>
5656 Post '[JSON] (Headers '[Header "Set-Cookie" String] UserId) :<|>
57− "logout" :>
57+ "logout" :>
5858 PostNoContent '[JSON, PlainText, FormUrlEncoded] (Headers '[Header "Set-Cookie" String] NoContent)
5959
6060newtype AuthenticationCredits = AuthenticationCredits {authenticationId :: UserId}
@@ -70,21 +70,23 @@ logIn :: AuthenticationCredits -> App (Headers '[Header "Set-Cookie" String] Use
7070logIn (AuthenticationCredits uId) = do
7171 expire <- liftIO $ fmap (addUTCTime (1 * 24 * 60 * 60)) getCurrentTime -- one days
7272 tId <- fmap userId . runQ err404 . getUser $ uId
73− let cookie = defaultSetCookie {
74− setCookieName = cookieTokenKey,
75− setCookieValue = C.pack $ show tId,
76− setCookieExpires = Just expire,
77− setCookiePath = Just "/" }
78− return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) tId
73+ let cookie = defaultSetCookie {
74+ setCookieName = cookieTokenKey,
75+ setCookieValue = C.pack $ show tId,
76+ setCookieExpires = Just expire,
77+ setCookiePath = Just "/",
78+ setCookieHttpOnly = True,
79+ setCookieSecure = True }
80+ return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) tId
7981
8082logOut :: App (Headers '[Header "Set-Cookie" String] NoContent)
81−logOut =
82− let cookie = defaultSetCookie {
83− setCookieName = cookieTokenKey,
84− setCookieValue = "invalid",
85− setCookieExpires = Just (UTCTime (ModifiedJulianDay 0) 0),
83+logOut =
84+ let cookie = defaultSetCookie {
85+ setCookieName = cookieTokenKey,
86+ setCookieValue = "invalid",
87+ setCookieExpires = Just (UTCTime (ModifiedJulianDay 0) 0),
8688 setCookiePath = Just "/" }
87− in return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) NoContent
89+ in return $ addHeader (L.unpack . toLazyByteString . renderSetCookie $ cookie) NoContent
8890
8991checkToken :: DBConnection -> BS.ByteString -> Handler UserId
9092checkToken conn token = do