Improve login and cookie handling #76

line-o · 2024-09-22T23:08:45Z

Please have a look at the documentation for the new feature:
https://github.com/eeditiones/roaster/blob/3b0ab4e867a21683bb00b93ab0be7809b6200887/doc/cookie-auth.md

FEATURES

allow and encourage custom login route handlers
- read user name and login from any body or header content including XML bodies
allow and encourage custom logout route handlers
allows setting HttpOnly and SameSite attributes on login domain cookies (implementation in content/cookie.xqm)

FIXES

no redirect needed for logout, nor logout=true
do not attempt to login on every request
get rid of hard-coded field names user, password

DrRataplan · 2025-08-27T09:05:03Z

content/cookie.xqm

+        error($errors:OPERATION, "cookie:set: Cookie name and value must be set", ($name, $value))
+    ) else
+    if (matches($name, $cookie:enforce-rfc2109)) then (
+        error($errors:OPERATION, "cookie:set: Cookie name contains illegal charecters", $name)


DrRataplan · 2025-09-23T14:09:57Z

.github/workflows/node.js.yml

        uses: actions/setup-node@v3
        with:
-          node-version: 16
+          node-version: 20


lets do 22 (or 24) already

DrRataplan · 2025-09-23T14:11:17Z

content/auth.xql

+declare variable $auth:DEFAULT_LOGIN_OPTIONS := map {
+    "asDba": true(), 
+    "maxAge": xs:dayTimeDuration("P7D"),
+    "Path": request:get-context-path(),


inconsistent casing. can we make it consistent?

Turns out, not, not really. Some options come from outside specifications.

I would love to come up with an easy use and easy to explain way for those.

DrRataplan · 2025-09-23T14:14:38Z

content/auth.xql

+    let $cookie-name := auth:read-cookie-name($request?spec)
+    return
+        if (empty($cookie-name)) then (
+            error($errors:OPERATION, 'Cookie-name not specified in API-definition!')


The actual place where the cookie should be in the definition is components.securitySchemes.cookieAuth.name. Let's mention that in the error

Yes, that's a great addition to the error message

DrRataplan · 2025-09-23T14:15:34Z

content/auth.xql

+declare function auth:login-user ($user as xs:string, $password as xs:string, $options as map(*)) as xs:string? {
+    let $merged-options :=
+        if (empty($options?name)) then (
+            error($errors:OPERATION, 'Cookie-name not set in call to auth:login-user!')


Same here, error should mention components.securitySchemes.cookieAuth.name

For this function that is actually not the case. It has to be in the options parameter. I will add this instead.

DrRataplan · 2025-09-23T14:17:01Z

content/auth.xql

+        ) else if ($merged-options?maxAge instance of xs:integer) then (
+            xs:dayTimeDuration('PT' || $merged-options?maxAge || 'S')
+        ) else (
+            error($errors:OPERATION, "the maxAge option value cannot be used", $merged-options?maxAge)


The maxAge option should either be an xs:dayTimeDuration or an xs:integer expressing the amount of seconds. The value YADAYADA cannot be used.

What about

The value of maxAge must be of type xs:dayTimeDuration or xs:integer. The given value $merged-options?maxAge cannot be used

DrRataplan · 2025-09-23T14:17:17Z

content/auth.xql

+declare function auth:logout-user ($options as map(*)) as empty-sequence() {
+    let $token :=
+        if (empty($options?name)) then (
+            error($errors:OPERATION, 'Cookie-name not set in call to auth:logout-user!')


components.securitySchemes.cookieAuth.name

This error is repeated. Maybe make add

declare %private function auth:ensure-cookie-name ( $name as xs:string ) as xs:string { if (exists($name)) then $name else error( $errors:OPERATION, "The components.securitySchemes.cookieAuth.name is empty." ) };

what about

declare %private function auth:ensure-cookie-name ( $name as xs:string? ) as xs:string { head(( $name, error( $errors:OPERATION, "The components.securitySchemes.cookieAuth.name is empty." ) )) };

- Use persistent login module directly to allow custom login and logout route handlers. - Logout route does not need to redirect anymore. - Add cookie.xqm utility module that is package private. - Add custom login and logout route handlers to test app. - Add and extend tests for login and logout.

When a route tries to call a handler function that does not exist, roaster will return with status code 500 and an actionable description: "Operation not found for operationId:<operationId>"

- use cookie-name everywhere and deprecate "login domain" - guard against cookie-name not being set

line-o · 2025-12-04T16:40:53Z

@DrRataplan exciting news: It turns out all keys in cookies are case-insensitive. That means we could do all keys in lower case!

 map {
    "name": "awesome.cookie",
    "value": "._.*^*._.*^*._.*^*._.*^*._.*",
    "max-age": xs:dayTimeDuration("P1D"),
    "path": "/",
    "samesite": "Strict",
    "secure": false(),
     "httponly": true()
}

source https://www.rfc-editor.org/rfc/rfc6265.html in Chapter 5.2. The Set-Cookie Header

line-o requested review from DrRataplan and duncdrum September 22, 2024 23:09

line-o added the enhancement New feature or request label Apr 3, 2025

DrRataplan reviewed Sep 23, 2025

View reviewed changes

duncdrum approved these changes Sep 23, 2025

View reviewed changes

line-o added 10 commits November 26, 2025 12:17

deps: update axios to 1.7.5

ff6d1f7

test: remove test from paths.test that is now part of auth.test

7d75a96

fix: raise specific error when route handler is not found

f9a3a59

When a route tries to call a handler function that does not exist, roaster will return with status code 500 and an actionable description: "Operation not found for operationId:<operationId>"

chore(test): fix formatting

096a875

build: use node v20

1e2b3a5

fix: cookie module must be exported

f8140b0

feat: allow cookie lifetime to be set in seconds

54965fc

- use cookie-name everywhere and deprecate "login domain" - guard against cookie-name not being set

chore: minor cleanup

f7e1a0e

doc: explain new cookie authentication

fb33a35

line-o force-pushed the feat/better-login branch from 3b0ab4e to fb33a35 Compare November 27, 2025 16:09

Uh oh!

Improve login and cookie handling #76

Are you sure you want to change the base?

Improve login and cookie handling #76

Uh oh!

Conversation

line-o commented Sep 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

line-o Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

line-o commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

line-o commented Sep 22, 2024 •

edited

Loading

line-o Sep 29, 2025 •

edited

Loading

line-o commented Dec 4, 2025 •

edited

Loading