@adobe/helix-html-pipeline 3.5.0 → 3.6.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [3.6.0](https://github.com/adobe/helix-html-pipeline/compare/v3.5.0...v3.6.0) (2022-10-27)
+
+
+### Features
+
+* also support x-fwd-scheme ([#172](https://github.com/adobe/helix-html-pipeline/issues/172)) ([845a5a0](https://github.com/adobe/helix-html-pipeline/commit/845a5a0dada33a3950ffed4f7d6a52090fa6de9a))
+
 # [3.5.0](https://github.com/adobe/helix-html-pipeline/compare/v3.4.6...v3.5.0) (2022-10-26)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/utils/auth-cookie.js

@@ -11,21 +11,21 @@
  */
 import { parse, serialize } from 'cookie';
 
-export function clearAuthCookie() {
+export function clearAuthCookie(secure) {
   return serialize('hlx-auth-token', '', {
     path: '/',
     httpOnly: true,
-    secure: true,
+    secure,
     expires: new Date(0),
     sameSite: 'lax',
   });
 }
 
-export function setAuthCookie(idToken) {
+export function setAuthCookie(idToken, secure) {
   return serialize('hlx-auth-token', idToken, {
     path: '/',
     httpOnly: true,
-    secure: true,
+    secure,
     sameSite: 'lax',
   });
 }

package/src/utils/auth.js

@@ -91,7 +91,8 @@ function getRequestHostAndProto(state, req) {
   if (!host) {
     host = state.config.host;
   }
-  const proto = req.headers.get('x-forwarded-proto') || 'https';
+  // fastly overrides the x-forwarded-proto, so we use x-forwarded-scheme
+  const proto = req.headers.get('x-forwarded-scheme') || req.headers.get('x-forwarded-proto') || 'https';
   state.log.info(`request host is: ${host} (${proto})`);
   return {
     host,
@@ -218,7 +219,7 @@ export class AuthInfo {
     res.status = 302;
     res.body = '';
     res.headers.set('location', url.href);
-    res.headers.set('set-cookie', clearAuthCookie());
+    res.headers.set('set-cookie', clearAuthCookie(proto === 'https'));
     res.headers.set('cache-control', 'no-store, private, must-revalidate');
     res.error = 'moved';
   }
@@ -299,12 +300,12 @@ export class AuthInfo {
     // ctx.attributes.authInfo?.withCookieInvalid(false);
 
     const location = state.createExternalLocation(req.params.state.requestPath || '/');
-    log.info('[auth] redirecting to home page with id_token cookie', location);
+    log.info('[auth] redirecting to original page with hlx-auth-token cookie: ', location);
     res.status = 302;
     res.body = `please go to <a href="${location}">${location}</a>`;
     res.headers.set('location', location);
     res.headers.set('content-tye', 'text/plain');
-    res.headers.set('set-cookie', setAuthCookie(idToken));
+    res.headers.set('set-cookie', setAuthCookie(idToken, req.params.state.requestProto === 'https'));
     res.headers.set('cache-control', 'no-store, private, must-revalidate');
     res.error = 'moved';
   }