From 622bf1e440cdad7d70285763b8698a756c1746e9 Mon Sep 17 00:00:00 2001 From: Leonid Pershin Date: Fri, 24 Jul 2026 23:15:08 +0300 Subject: [PATCH] Implement stream cookie deletion in logout and account deletion endpoints: add DeleteStreamCookie method to remove the stream cookie upon user logout and account deletion, enhancing security by preventing access to streams after token expiration. --- .../src/TeleWave.Api/Endpoints/AuthEndpoints.cs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/backend/src/TeleWave.Api/Endpoints/AuthEndpoints.cs b/backend/src/TeleWave.Api/Endpoints/AuthEndpoints.cs index 14e19cd..82058bb 100644 --- a/backend/src/TeleWave.Api/Endpoints/AuthEndpoints.cs +++ b/backend/src/TeleWave.Api/Endpoints/AuthEndpoints.cs @@ -134,6 +134,7 @@ public static class AuthEndpoints await sender.Send(new LogoutCommand(rawToken), cancellationToken); response.Cookies.Delete(RefreshCookieName, BuildCookieOptions(request)); + DeleteStreamCookie(request, response); return Results.NoContent(); } @@ -172,6 +173,7 @@ public static class AuthEndpoints { var result = await sender.Send(new DeleteMyAccountCommand(), cancellationToken); response.Cookies.Delete(RefreshCookieName, BuildCookieOptions(request)); + DeleteStreamCookie(request, response); return result.ToHttpResult(); } @@ -195,6 +197,20 @@ public static class AuthEndpoints SameSite = SameSiteMode.Strict, Path = "/api/auth", }; + + /// Гасит stream-cookie (tw_stream, Path=/api) — иначе после выхода эфир можно смотреть + /// по прямой ссылке ещё до истечения токена. + private static void DeleteStreamCookie(HttpRequest request, HttpResponse response) => + response.Cookies.Delete( + "tw_stream", + new CookieOptions + { + HttpOnly = true, + Secure = request.IsHttps, + SameSite = SameSiteMode.Strict, + Path = "/api", + } + ); } public sealed record AuthResponseDto(