Add db table for login tokens which allows for invalidation

crates/api/src/lib.rs

@@ -1,4 +1,4 @@
-use actix_web::{cookie::SameSite, http::header::Header, HttpRequest};
+use actix_web::{http::header::Header, HttpRequest};
 use actix_web_httpauth::headers::authorization::{Authorization, Bearer};
 use base64::{engine::general_purpose::STANDARD_NO_PAD as base64, Engine};
 use captcha::Captcha;
@@ -76,14 +76,12 @@ pub fn read_auth_token(req: &HttpRequest) -> Result<Option<String>, LemmyError>
   if let Ok(header) = Authorization::<Bearer>::parse(req) {
     Ok(Some(header.as_ref().token().to_string()))
   }
-  // If that fails, try auth cookie. Dont use the `jwt` cookie from lemmy-ui because
-  // its not http-only.
+  // If that fails, try to read from cookie
   else if let Some(cookie) = &req.cookie(AUTH_COOKIE_NAME) {
     // ensure that its marked as httponly and secure
     let secure = cookie.secure().unwrap_or_default();
     let http_only = cookie.http_only().unwrap_or_default();
-    let same_site = cookie.same_site();
-    if !secure || !http_only || same_site != Some(SameSite::Strict) {
+    if !secure || !http_only {
       Err(LemmyError::from(LemmyErrorType::AuthCookieInsecure))
     } else {
       Ok(Some(cookie.value().to_string()))

crates/api_common/src/utils.rs

@@ -44,7 +44,7 @@ use rosetta_i18n::{Language, LanguageId};
 use tracing::warn;
 use url::{ParseError, Url};
 
-pub static AUTH_COOKIE_NAME: &str = "auth";
+pub static AUTH_COOKIE_NAME: &str = "jwt";
 
 #[tracing::instrument(skip_all)]
 pub async fn is_mod_or_admin(
@@ -754,7 +754,7 @@ pub fn sanitize_html_federation_opt(data: &Option<String>) -> Option<String> {
 pub fn create_login_cookie(jwt: Sensitive<String>) -> Cookie<'static> {
   let mut cookie = Cookie::new(AUTH_COOKIE_NAME, jwt.into_inner());
   cookie.set_secure(true);
-  cookie.set_same_site(SameSite::Strict);
+  cookie.set_same_site(SameSite::Lax);
   cookie.set_http_only(true);
   cookie
 }

crates/db_schema/src/source/login_token.rs

@@ -4,15 +4,20 @@ use crate::schema::login_token;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 
+/// Stores data related to a specific user login session.
 #[derive(Clone, PartialEq, Eq, Debug, Serialize, Deserialize)]
 #[cfg_attr(feature = "full", derive(Queryable, Identifiable))]
 #[cfg_attr(feature = "full", diesel(table_name = login_token))]
 pub struct LoginToken {
   pub id: i32,
+  /// Jwt token for this login
   #[serde(skip)]
   pub token: String,
   pub user_id: LocalUserId,
+  /// Time of login
   pub published: DateTime<Utc>,
+  /// IP address where login was made from, allows invalidating logins by IP address.
+  /// Could be stored in truncated format, or store derived information for better privacy.
   pub ip: Option<String>,
   pub user_agent: Option<String>,
 }

crates/utils/src/error.rs

@@ -212,6 +212,7 @@ pub enum LemmyErrorType {
   CouldntSendWebmention,
   ContradictingFilters,
   InstanceBlockAlreadyExists,
+  #[serde(rename = "`jwt` cookie must be marked secure and httponly")]
   AuthCookieInsecure,
   Unknown(String),
 }