Refactor authentication and streaming cookie handling: implement secure cookie logic based on environment in AuthEndpoints and StreamingEndpoints, enhance rate limiting policy in Program.cs, and update logging configuration in appsettings.json. Fix validation behavior to use asynchronous validation methods and improve error handling in frontend components.

2026-07-25 21:18:31 +03:00
parent 53e0eeb776
commit 058cbc6994
15 changed files with 282 additions and 99 deletions
@@ -2,6 +2,7 @@ using System.Globalization;
 using System.Text;
 using System.Text.RegularExpressions;
 using LiteCqrs;
+using Microsoft.Extensions.Hosting;
 using TeleWave.Api.Common;
 using TeleWave.Application.Common.Interfaces;
 using TeleWave.Application.Streaming;
@@ -47,7 +48,8 @@ public static class StreamingEndpoints
        ICurrentUser currentUser,
        StreamTokenService tokens,
        HttpRequest request,
-        HttpResponse response
+        HttpResponse response,
+        IHostEnvironment env
    )
    {
        if (currentUser.UserId is not { } userId)
@@ -60,7 +62,9 @@ public static class StreamingEndpoints
            new CookieOptions
            {
                HttpOnly = true,
-                Secure = request.IsHttps,
+                // Вне Development — всегда Secure (прод за внешним TLS-прокси; request.IsHttps ненадёжен
+                // при неполной настройке ForwardedHeaders). См. UseSecureCookie в AuthEndpoints.
+                Secure = !env.IsDevelopment() || request.IsHttps,
                SameSite = SameSiteMode.Strict,
                Path = "/api",
                Expires = expiresAt,