diff --git a/src/core/plugins/auth/wrap-actions.js b/src/core/plugins/auth/wrap-actions.js index 8be692b3f746..a39775cf0d42 100644 --- a/src/core/plugins/auth/wrap-actions.js +++ b/src/core/plugins/auth/wrap-actions.js @@ -25,7 +25,7 @@ export const authorize = (oriAction, system) => (payload) => { if (isApiKeyInCookie) { const secure = `${configs.url?.split("/")[0] === "https:" ? ";secure" : ""}` - const urlBasePath = configs.url?.split("/")[3] + const urlBasePath = configs.url?.split("/").splice(3).join("/") const path = `${urlBasePath === undefined ? ";path=/" : ";path=/".concat(urlBasePath)}` let cookieStr = `${schema.get("name")}=${value};samesite=None${secure}${path}` document.cookie = cookieStr @@ -53,7 +53,7 @@ export const logout = (oriAction, system) => (payload) => { if (isApiKeyInCookie) { const cookieName = auth.getIn(["schema", "name"]) - const urlBasePath = configs.url?.split("/")[3] + const urlBasePath = configs.url?.split("/").splice(3).join("/") const path = `${urlBasePath === undefined ? ";path=/" : ";path=/".concat(urlBasePath)}` document.cookie = `${cookieName}=;max-age=-99999999${path}` } diff --git a/test/unit/core/plugins/auth/wrap-actions.js b/test/unit/core/plugins/auth/wrap-actions.js index ff2e8f6269d5..ed7895184950 100644 --- a/test/unit/core/plugins/auth/wrap-actions.js +++ b/test/unit/core/plugins/auth/wrap-actions.js @@ -117,6 +117,31 @@ describe("Cookie based apiKey persistence in document.cookie", () => { ) }) + it("should persist secure cookie in document.cookie for SSL targets with non-root multi-level base path", () => { + const system = { + getConfigs: () => ({ + persistAuthorization: true, + url: "https://example.org/api/production" + }), + } + const payload = { + api_key: { + schema: fromJS({ + type: "apiKey", + name: "apiKeyCookie", + in: "cookie", + }), + value: "test", + }, + } + + authorize(jest.fn(), system)(payload) + + expect(document.cookie).toEqual( + "apiKeyCookie=test;samesite=None;secure;path=/api/production" + ) + }) + it("should delete cookie from document.cookie", () => { const payload = fromJS({ api_key: { @@ -141,6 +166,32 @@ describe("Cookie based apiKey persistence in document.cookie", () => { expect(document.cookie).toEqual("apiKeyCookie=;max-age=-99999999;path=/") }) + + it("should delete cookie from document.cookie for targets with non-root multi-level base path", () => { + const payload = fromJS({ + api_key: { + schema: { + type: "apiKey", + name: "apiKeyCookie", + in: "cookie", + }, + value: "test", + }, + }) + const system = { + getConfigs: () => ({ + persistAuthorization: true, + url: "https://example.org/api/production" + }), + authSelectors: { + authorized: () => payload, + }, + } + + logout(jest.fn(), system)(["api_key"]) + + expect(document.cookie).toEqual("apiKeyCookie=;max-age=-99999999;path=/api/production") + }) }) describe("given persistAuthorization=false", () => { @@ -191,4 +242,30 @@ describe("Cookie based apiKey persistence in document.cookie", () => { expect(document.cookie).toEqual("") }) }) + + it("should delete cookie from document.cookie for targets with non-root multi-level base path", () => { + const payload = fromJS({ + api_key: { + schema: { + type: "apiKey", + name: "apiKeyCookie", + in: "cookie", + }, + value: "test", + }, + }) + const system = { + getConfigs: () => ({ + persistAuthorization: false, + url: "https://example.org/api/production" + }), + authSelectors: { + authorized: () => payload, + }, + } + + logout(jest.fn(), system)(["api_key"]) + + expect(document.cookie).toEqual("") + }) })