@flowfuse/nr-launcher 2.32.1 → 2.32.2-26137df-202607301241.0

package/lib/auth/httpAuthMiddleware.js

@@ -77,6 +77,7 @@ module.exports = {
         passport = new Passport()
         httpNodeApp = app
 
+        const crossSiteCookie = (options.baseURL || '').startsWith('https://')
         httpNodeApp.use(session({
         // As the session is only used across the life-span of an auth
         // hand-shake, we can use a instance specific random string
@@ -85,7 +86,8 @@ module.exports = {
             saveUninitialized: false,
             store: new MemoryStore({
                 checkPeriod: 86400000 // prune expired entries every 24h
-            })
+            }),
+            cookie: crossSiteCookie ? { sameSite: 'none', secure: true, partitioned: true } : {}
         }))
 
         app.use(passport.initialize())

package/lib/runtimeSettings.js

@@ -68,13 +68,16 @@ function getSettingsFile (settings) {
             if (settings.settings.dashboardUI !== undefined) {
                 dashboardSettings.push(`path: '${settings.settings.dashboardUI}'`)
             }
-            if (authMiddlewareRequired && settings.settings.dashboardIFrame) {
-                dashboardSettings.push('middleware: flowforgeAuthMiddleware.concat(DashboardIFrameMiddleware)')
-            } else if (authMiddlewareRequired && !settings.settings.dashboardIFrame) {
-                dashboardSettings.push('middleware: flowforgeAuthMiddleware')
-            } else if (!authMiddlewareRequired && settings.settings.dashboardIFrame) {
-                dashboardSettings.push('middleware: [ DashboardIFrameMiddleware ]')
+            const middlewares = []
+            if (authMiddlewareRequired) {
+                middlewares.push('...flowforgeAuthMiddleware')
             }
+            if (settings.settings.dashboardIFrame) {
+                middlewares.push('DashboardIFrameMiddleware')
+            } else {
+                middlewares.push('DashboardCSPMiddleware')
+            }
+            dashboardSettings.push(`middleware: [ ${middlewares.join(', ')} ]`)
             if (settings.settings.apiMaxLength) {
                 try {
                     dashboardSettings.push(`maxHttpBufferSize: ${bytes(settings.settings.apiMaxLength)}`)
@@ -349,6 +352,10 @@ function getSettingsFile (settings) {
 
     const settingsTemplate = `
 ${projectSettings.setupAuthMiddleware}
+const DashboardCSPMiddleware = async function(req,res,next) {
+    res.set("Content-Security-Policy", "frame-ancestors 'self' ${settings.forgeURL}");
+    next()
+}
 const DashboardIFrameMiddleware = async function(req,res,next) {
     res.set("Content-Security-Policy", "frame-ancestors *");
     next()