Merge pull request #2964 from cesanta/http-cookie

Use separate cookies for HTTP and HTTPS connections

examples/device-dashboard/net.c

@@ -77,19 +77,22 @@ static struct user *authenticate(struct mg_http_message *hm) {
 
 static void handle_login(struct mg_connection *c, struct user *u) {
   char cookie[256];
+  const char *cookie_name = c->is_tls ? "secure_access_token" : "access_token";
   mg_snprintf(cookie, sizeof(cookie),
-              "Set-Cookie: access_token=%s; Path=/; "
+              "Set-Cookie: %s=%s; Path=/; "
               "%sHttpOnly; SameSite=Lax; Max-Age=%d\r\n",
-              u->access_token, c->is_tls ? "Secure; " : "", 3600 * 24);
+              cookie_name, u->access_token,
+              c->is_tls ? "Secure; " : "", 3600 * 24);
   mg_http_reply(c, 200, cookie, "{%m:%m}", MG_ESC("user"), MG_ESC(u->name));
 }
 
 static void handle_logout(struct mg_connection *c) {
   char cookie[256];
+  const char *cookie_name = c->is_tls ? "secure_access_token" : "access_token";
   mg_snprintf(cookie, sizeof(cookie),
-              "Set-Cookie: access_token=; Path=/; "
+              "Set-Cookie: %s=; Path=/; "
               "Expires=Thu, 01 Jan 1970 00:00:00 UTC; "
-              "%sHttpOnly; Max-Age=0; \r\n",
+              "%sHttpOnly; Max-Age=0; \r\n", cookie_name,
               c->is_tls ? "Secure; " : "");
   mg_http_reply(c, 200, cookie, "true\n");
 }

examples/wifi-router-dashboard/net.c

@@ -156,19 +156,23 @@ static struct user *authenticate(struct mg_http_message *hm) {
 
 static void handle_login(struct mg_connection *c, struct user *u) {
   char cookie[256];
+  const char *cookie_name = c->is_tls ? "secure_access_token" : "access_token";
   mg_snprintf(cookie, sizeof(cookie),
-              "Set-Cookie: access_token=%s;Path=/;"
+              "Set-Cookie: %s=%s;Path=/;"
-              "HttpOnly;SameSite=Lax;Max-Age=%d\r\n",
+              "%sHttpOnly;SameSite=Lax;Max-Age=%d\r\n", cookie_name,
-              u->access_token, 3600 * 24);
+              u->access_token, c->is_tls ? "Secure; " : "", 3600 * 24);
   mg_http_reply(c, 200, cookie, "{%m:%m}", MG_ESC("user"), MG_ESC(u->name));
 }
 
 static void handle_logout(struct mg_connection *c) {
-  mg_http_reply(c, 200,
+  char cookie[256];
-                "Set-Cookie: access_token=; Path=/; "
+  const char *cookie_name = c->is_tls ? "secure_access_token" : "access_token";
-                "Expires=Thu, 01 Jan 1970 00:00:00 UTC; "
+  mg_snprintf(cookie, sizeof(cookie),
-                "Secure; HttpOnly; Max-Age=0; \r\n",
+              "Set-Cookie: %s=; Path=/; "
-                "true\n");
+              "Expires=Thu, 01 Jan 1970 00:00:00 UTC; "
+              "%sHttpOnly; Max-Age=0; \r\n", cookie_name,
+              c->is_tls ? "Secure; " : "");
+  mg_http_reply(c, 200, cookie, "true\n");
 }
 
 static void handle_debug(struct mg_connection *c, struct mg_http_message *hm) {

reference-projects/windows-macos-linux/web-ui-dashboard/net.c

@@ -78,19 +78,22 @@ static struct user *authenticate(struct mg_http_message *hm) {
 
 static void handle_login(struct mg_connection *c, struct user *u) {
   char cookie[256];
+  const char *cookie_name = c->is_tls ? "secure_access_token" : "access_token";
   mg_snprintf(cookie, sizeof(cookie),
-              "Set-Cookie: access_token=%s; Path=/; "
+              "Set-Cookie: %s=%s; Path=/; "
               "%sHttpOnly; SameSite=Lax; Max-Age=%d\r\n",
-              u->access_token, c->is_tls ? "Secure; " : "", 3600 * 24);
+              cookie_name, u->access_token,
+              c->is_tls ? "Secure; " : "", 3600 * 24);
   mg_http_reply(c, 200, cookie, "{%m:%m}", MG_ESC("user"), MG_ESC(u->name));
 }
 
 static void handle_logout(struct mg_connection *c) {
   char cookie[256];
+  const char *cookie_name = c->is_tls ? "secure_access_token" : "access_token";
   mg_snprintf(cookie, sizeof(cookie),
-              "Set-Cookie: access_token=; Path=/; "
+              "Set-Cookie: %s=; Path=/; "
               "Expires=Thu, 01 Jan 1970 00:00:00 UTC; "
-              "%sHttpOnly; Max-Age=0; \r\n",
+              "%sHttpOnly; Max-Age=0; \r\n", cookie_name,
               c->is_tls ? "Secure; " : "");
   mg_http_reply(c, 200, cookie, "true\n");
 }