requarks / wiki-v1

Legacy version (1.x) of Wiki.js
https://wiki.js.org
GNU Affero General Public License v3.0
101 stars 75 forks source link

Forced to log in again for every new browser session #84

Open lofidevops opened 6 years ago

lofidevops commented 6 years ago

Actual behavior

If I start a new browser session, when I visit the wiki I am asked to log in again.

Expected behavior

If I have first-party cookies enabled and I have logged in before, I expect to remain logged in, even after closing the browser.

Steps to reproduce the behavior

  1. Start browser
  2. Confirm that first-party cookies are allowed
  3. Visit wiki
  4. Log in as prompted
  5. Browse wiki
  6. Close browser
  7. Start browser
  8. Visit wiki
lofidevops commented 6 years ago

This could be implemented as an optional "Remember me" tickbox on the login page.

NGPixel commented 6 years ago

This is already the case.

Try forcing the maxAge option by editing this file and adding after line 114:

cookie: { path: '/', httpOnly: true, secure: false, maxAge: 1000 * 60 * 60 * 24 * 30 }
lofidevops commented 6 years ago

After logging in I inspected my cookies with Cookie Manager and found the following:

{
 "cookieManagerVersion": "1.4",
 "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 PureBrowser/52.7.3",
 "cookies": [
 {
  "name": "wikijs.sid",
  "value": "123456789",
  "domain": "wiki.example.com",
  "hostOnly": true,
  "path": "/",
  "secure": false,
  "httpOnly": true,
  "session": true,
  "storeId": "firefox-default"
 },
 {
  "name": "io",
  "value": "123456789",
  "domain": "wiki.example.com",
  "hostOnly": true,
  "path": "/",
  "secure": false,
  "httpOnly": true,
  "session": true,
  "storeId": "firefox-default"
 }
]
}

I then set the expiration date for wikijs.sid via Cookie Manager:

  "name": "wikijs.sid",
  "value": "123456789",
  "domain": "wiki.example.com",
  "hostOnly": true,
  "path": "/",
  "secure": false,
  "httpOnly": true,
  "expirationDate": 1577829540,
  "storeId": "firefox-default"

...and this resolved the issue (as a workaround).

Looking at referenced code block, it seems the cookie isn't explicitly set to either session-based or data-based, so I assume there's some underlying default. Would it be possible to make this explicit?