From 276493150449b6bcdba7efbe4e127fb1598b91ef Mon Sep 17 00:00:00 2001 From: ghaddaditw <40211818-ghaddaditw@users.noreply.replit.com> Date: Sun, 8 Jun 2025 09:38:08 +0000 Subject: [PATCH] Enhance website security and user session handling for improved login access Removes session/passport middleware and configures cookie settings with `sameSite: 'lax'` in `server/routes.ts`. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 8fac8604-8776-4090-bf16-1e3d01acb719 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9777c70b-fc38-4831-8d6b-78dfffe041b0/1c7d1edb-17da-4794-ab01-57bc59240867.jpg --- cookies.txt | 2 +- server/routes.ts | 15 ++------------- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/cookies.txt b/cookies.txt index f9b8496..223e3bb 100644 --- a/cookies.txt +++ b/cookies.txt @@ -2,4 +2,4 @@ # https://curl.se/docs/http-cookies.html # This file was generated by libcurl! Edit at your own risk. -#HttpOnly_localhost FALSE / FALSE 1749457367 connect.sid s%3AP2JsHCt-vR2OJSPLFX1DhMk6qrXcYLZE.xfHimUUG81WdrWDTUFs0nFOv%2Bd%2FA6mI2vMNziU4uRFo +#HttpOnly_localhost FALSE / FALSE 1749461849 connect.sid s%3A7zNq68aZliAxFVLCx2Je90dRY7pfLT09.S88988v3rhMbUHGcYdlwP%2BnTeYkWW4UYUggKYWfcgco diff --git a/server/routes.ts b/server/routes.ts index 2efa0c5..d5e3a8e 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -84,7 +84,8 @@ export async function registerRoutes(app: Express): Promise { cookie: { secure: false, // Set to true in production with HTTPS httpOnly: true, - maxAge: 24 * 60 * 60 * 1000 // 24 hours + maxAge: 24 * 60 * 60 * 1000, // 24 hours + sameSite: 'lax' // Allow cross-origin requests for development } })); @@ -357,19 +358,7 @@ export async function registerRoutes(app: Express): Promise { } }); - // Configure session middleware - app.use(session({ - secret: process.env.SESSION_SECRET || 'your-secret-key', - resave: false, - saveUninitialized: false, - cookie: { - secure: process.env.NODE_ENV === 'production', - maxAge: 24 * 60 * 60 * 1000 // 24 hours - } - })); - app.use(passport.initialize()); - app.use(passport.session()); // Authentication routes (with rate limiting) app.post('/api/auth/register', authRateLimit, authController.register);