feat: support custom cookie options

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Allow conditionally compiling the SSH WASM integration when building (closes [#337](https://github.com/tale/headplane/issues/337)).
 - Implemented the ability to customize the build with a custom script (see `./build.sh --help` for more information).
 - Attempt to warn against misconfigured cookie settings on the login page.
+- Made `server.cookie_max_age` and `server.cookie_domain` configurable (closes [#348](https://github.com/tale/headplane/issues/348)).
 
 ---
 

app/server/config/schema.ts

@@ -23,6 +23,8 @@ const serverConfig = type({
 	cookie_secret: '(32 <= string <= 32)?',
 	cookie_secret_path: 'string?',
 	cookie_secure: stringToBool,
+	cookie_domain: 'string?',
+	cookie_max_age: 'number.integer = 86400',
 })
 	.narrow((obj: Record<string, unknown>, ctx: any) => {
 		const hasVal = obj.cookie_secret != null && `${obj.cookie_secret}` !== '';
@@ -49,6 +51,8 @@ const partialServerConfig = type({
 	cookie_secret: '32 <= string <= 32?',
 	cookie_secret_path: 'string?',
 	cookie_secure: stringToBool.optional(),
+	cookie_domain: 'string?',
+	cookie_max_age: 'number.integer?',
 });
 
 const oidcConfig = type({

app/server/index.ts

@@ -62,8 +62,8 @@ const appLoadContext = {
 		cookie: {
 			name: '_hp_auth',
 			secure: config.server.cookie_secure,
-			maxAge: 60 * 60 * 24, // 24 hours
-			// domain: config.server.cookie_domain,
+			maxAge: config.server.cookie_max_age,
+			domain: config.server.cookie_domain,
 		},
 	}),
 

app/server/web/sessions.ts

@@ -152,13 +152,14 @@ class Sessionizer {
 }
 
 async function createSession(payload: JWTSession, options: AuthSessionOptions) {
+	const now = Math.floor(Date.now() / 1000);
 	const secret = createHash('sha256').update(options.secret, 'utf8').digest();
 	const jwt = await new EncryptJWT({
 		...payload,
 	})
 		.setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ: 'JWT' })
 		.setIssuedAt()
-		.setExpirationTime('1d')
+		.setExpirationTime(now + options.cookie.maxAge)
 		.setIssuer('urn:tale:headplane')
 		.setAudience('urn:tale:headplane')
 		.setJti(ulid())

config.example.yaml

@@ -12,6 +12,14 @@ server:
   # (I recommend this is true in production)
   cookie_secure: true
 
+  # The maximum age of the session cookie in seconds
+  cookie_max_age: 86400 # 1 day in seconds
+
+  # This is not required, but if you want to restrict the cookie
+  # to a specific domain, set it here. Otherwise leave it commented out.
+  # This may not work as expected if not using a reverse proxy.
+  # cookie_domain: ""
+
   # The path to persist Headplane specific data. All data going forward
   # is stored in this directory, including the internal database and
   # any cache related files.