From c5a3bc1b511b58209e056c2643eade60ff844a64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ga=C3=ABl=20Deest?= Date: Wed, 23 Mar 2022 23:52:12 +0100 Subject: [PATCH] Set XSRF cookie only when authentication succeeds if no error is thrown --- .../src/Servant/Auth/Server/Internal.hs | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/servant-auth/servant-auth-server/src/Servant/Auth/Server/Internal.hs b/servant-auth/servant-auth-server/src/Servant/Auth/Server/Internal.hs index 2e825c0a..0ce409c2 100644 --- a/servant-auth/servant-auth-server/src/Servant/Auth/Server/Internal.hs +++ b/servant-auth/servant-auth-server/src/Servant/Auth/Server/Internal.hs @@ -54,15 +54,12 @@ instance ( n ~ 'S ('S 'Z) makeCookies :: AuthResult v -> IO (SetCookieList ('S ('S 'Z))) makeCookies authResult = do - xsrf <- makeXsrfCookie cookieSettings - fmap (Just xsrf `SetCookieCons`) $ - case authResult of - (Authenticated v) -> do - ejwt <- makeSessionCookie cookieSettings jwtSettings v - case ejwt of - Nothing -> return $ Nothing `SetCookieCons` SetCookieNil - Just jwt -> return $ Just jwt `SetCookieCons` SetCookieNil - _ -> return $ Nothing `SetCookieCons` SetCookieNil + case authResult of + (Authenticated v) -> do + ejwt <- makeSessionCookie cookieSettings jwtSettings v + xsrf <- makeXsrfCookie cookieSettings + return $ Just xsrf `SetCookieCons` (ejwt `SetCookieCons` SetCookieNil) + _ -> return $ Nothing `SetCookieCons` (Nothing `SetCookieCons` SetCookieNil) go :: (AuthResult v -> ServerT api Handler) -> (AuthResult v, SetCookieList n)