mirror of
https://github.com/fastapi-users/fastapi-users.git
synced 2025-08-15 11:11:16 +08:00
7138143923
* logout response sets proper response headers logout response is using starlette delete cookie. In starlette the samesite and secure attributes are not in the header but are needed to set the removed cookie client side. Implementing set_cookie with an empty cookie-value and a max_age of 0 will set a new expired cookie by the client. related issue #846 * fixed linting Co-authored-by: Pentem <martijn.pentenga@movares.nl>
67 lines
2.1 KiB
Python
67 lines
2.1 KiB
Python
from typing import Any, Optional
|
|
|
|
from fastapi import Response, status
|
|
from fastapi.security import APIKeyCookie
|
|
|
|
from fastapi_users.authentication.transport.base import Transport
|
|
from fastapi_users.openapi import OpenAPIResponseType
|
|
|
|
|
|
class CookieTransport(Transport):
|
|
scheme: APIKeyCookie
|
|
|
|
def __init__(
|
|
self,
|
|
cookie_name: str = "fastapiusersauth",
|
|
cookie_max_age: Optional[int] = None,
|
|
cookie_path: str = "/",
|
|
cookie_domain: Optional[str] = None,
|
|
cookie_secure: bool = True,
|
|
cookie_httponly: bool = True,
|
|
cookie_samesite: str = "lax",
|
|
):
|
|
self.cookie_name = cookie_name
|
|
self.cookie_max_age = cookie_max_age
|
|
self.cookie_path = cookie_path
|
|
self.cookie_domain = cookie_domain
|
|
self.cookie_secure = cookie_secure
|
|
self.cookie_httponly = cookie_httponly
|
|
self.cookie_samesite = cookie_samesite
|
|
self.scheme = APIKeyCookie(name=self.cookie_name, auto_error=False)
|
|
|
|
async def get_login_response(self, token: str, response: Response) -> Any:
|
|
response.set_cookie(
|
|
self.cookie_name,
|
|
token,
|
|
max_age=self.cookie_max_age,
|
|
path=self.cookie_path,
|
|
domain=self.cookie_domain,
|
|
secure=self.cookie_secure,
|
|
httponly=self.cookie_httponly,
|
|
samesite=self.cookie_samesite,
|
|
)
|
|
|
|
# We shouldn't return directly the response
|
|
# so that FastAPI can terminate it properly
|
|
return None
|
|
|
|
async def get_logout_response(self, response: Response) -> Any:
|
|
response.set_cookie(
|
|
self.cookie_name,
|
|
"",
|
|
max_age=0,
|
|
path=self.cookie_path,
|
|
domain=self.cookie_domain,
|
|
secure=self.cookie_secure,
|
|
httponly=self.cookie_httponly,
|
|
samesite=self.cookie_samesite,
|
|
)
|
|
|
|
@staticmethod
|
|
def get_openapi_login_responses_success() -> OpenAPIResponseType:
|
|
return {status.HTTP_200_OK: {"model": None}}
|
|
|
|
@staticmethod
|
|
def get_openapi_logout_responses_success() -> OpenAPIResponseType:
|
|
return {status.HTTP_200_OK: {"model": None}}
|