admin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(session-storage): add typing and trust proxy setting (#9725)

Browse Source 
Added explicit typing for session storage options to improve type
safety. Enabled 'trust proxy' to ensure proper client IP and protocol
detection behind proxies. These changes improve security and reliability
in session handling.
This commit is contained in:
Antoine Moreaux
2025-01-20 11:05:34 +01:00
committed by GitHub
parent 7ed2c12e7a
commit 2c8954a44d
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/twenty-server/src/engine/core-modules/session-storage/session-storage.module-factory.ts
View File

@ -14,10 +14,11 @@ export const getSessionStorageOptions = (
const SERVER_URL = environmentService.get('SERVER_URL');
const sessionStorage = {
const sessionStorage: session.SessionOptions = {
secret: environmentService.get('SESSION_STORE_SECRET'),
resave: false,
saveUninitialized: false,
proxy: true,
cookie: {
secure: !!(SERVER_URL && SERVER_URL.startsWith('https')),
maxAge: 1000 * 60 * 30, // 30 minutes

5
packages/twenty-server/src/main.ts
View File

@ -38,6 +38,8 @@ const bootstrap = async () => {
const logger = app.get(LoggerService);
const environmentService = app.get(EnvironmentService);
app.use(session(getSessionStorageOptions(environmentService)));
// TODO: Double check this as it's not working for now, it's going to be helpful for durable trees in twenty "orm"
// // Apply context id strategy for durable trees
// ContextIdFactory.apply(new AggregateByWorkspaceContextIdStrategy());
@ -83,9 +85,6 @@ const bootstrap = async () => {
// Inject the server url in the frontend page
generateFrontConfig();
// Enable session - Today it's used only for SSO
app.use(session(getSessionStorageOptions(environmentService)));
await app.listen(environmentService.get('PORT'));
};