refactor: Improve cookie security and centralized utility#9240
Merged
Conversation
… with specific options for better security and control 📝 (use-post-refresh-access.ts): Update cookies.set calls to use setCookieWithOptions function for consistent cookie settings ♻️ (utils.ts): Refactor setCookieWithOptions function to include httpOnly option and update sameSite values to lowercase for consistency
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThe changes centralize and standardize cookie option configuration in the frontend codebase by introducing a utility function, Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
github-actions
Bot
added
refactor
mfortman11
requested changes
Jul 29, 2025
Collaborator
mfortman11
left a comment
mfortman11
left a comment
There was a problem hiding this comment.
Let's add a unit test around the util functions
| return version; | ||
| }; | ||
|
|
||
| export const setCookieWithOptions = (): CookieOptions => ({ |
Collaborator
There was a problem hiding this comment.
if you're going to name this setCookieWithOptions and make it a function can you have it perform the whole cookie.set operation? Otherwise feels like this should be a constant or be called getCookieOptions
Member
Author
There was a problem hiding this comment.
hey @mfortman11 could you please check again.
I changed the approach.
…aging cookies in auth context 🔧 (frontend): refactor authStore to use new cookie hooks for managing access token and api key cookies 🔧 (frontend): refactor use-post-logout and use-post-refresh-access to use new cookie hooks for cookie management
github-actions
Bot
added
refactor
mfortman11
approved these changes
Jul 30, 2025
Collaborator
mfortman11
left a comment
mfortman11
left a comment
There was a problem hiding this comment.
Small comment to fix
…ccess to cookies in authStore and related components 🔧 (utils): Refactor getAuthCookie and setAuthCookie functions to use react-cookie directly for better code organization and readability
SonicDMG
temporarily deployed
to
cz/improve-cookie - langflow-manual-install PR #9240
Render
Destroyed
github-actions
Bot
added
refactor
Contributor
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
Codecov Report❌ Patch coverage is
❌ Your project status has failed because the head coverage (2.69%) is below the target coverage (10.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #9240 +/- ##
==========================================
+ Coverage 32.61% 34.92% +2.31%
==========================================
Files 1193 1431 +238
Lines 56001 66817 +10816
Branches 5278 5279 +1
==========================================
+ Hits 18264 23338 +5074
- Misses 37687 43419 +5732
- Partials 50 60 +10
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
github-actions
Bot
added
refactor
github-actions
Bot
added
refactor
|
2getsandesh
pushed a commit
to 2getsandesh/langflow-IBM
that referenced
this pull request
Aug 6, 2025
…i#9240) * ✨ (authContext.tsx): Add setCookieWithOptions function to set cookies with specific options for better security and control 📝 (use-post-refresh-access.ts): Update cookies.set calls to use setCookieWithOptions function for consistent cookie settings ♻️ (utils.ts): Refactor setCookieWithOptions function to include httpOnly option and update sameSite values to lowercase for consistency * 📝 (frontend): add useGetCookieAuth and useSetCookieAuth hooks for managing cookies in auth context 🔧 (frontend): refactor authStore to use new cookie hooks for managing access token and api key cookies 🔧 (frontend): refactor use-post-logout and use-post-refresh-access to use new cookie hooks for cookie management * 📝 (frontend): Remove redundant useGetCookieAuth hook and use direct access to cookies in authStore and related components 🔧 (utils): Refactor getAuthCookie and setAuthCookie functions to use react-cookie directly for better code organization and readability
lucaseduoli
pushed a commit
that referenced
this pull request
Aug 12, 2025
* ✨ (authContext.tsx): Add setCookieWithOptions function to set cookies with specific options for better security and control 📝 (use-post-refresh-access.ts): Update cookies.set calls to use setCookieWithOptions function for consistent cookie settings ♻️ (utils.ts): Refactor setCookieWithOptions function to include httpOnly option and update sameSite values to lowercase for consistency * 📝 (frontend): add useGetCookieAuth and useSetCookieAuth hooks for managing cookies in auth context 🔧 (frontend): refactor authStore to use new cookie hooks for managing access token and api key cookies 🔧 (frontend): refactor use-post-logout and use-post-refresh-access to use new cookie hooks for cookie management * 📝 (frontend): Remove redundant useGetCookieAuth hook and use direct access to cookies in authStore and related components 🔧 (utils): Refactor getAuthCookie and setAuthCookie functions to use react-cookie directly for better code organization and readability
lucaseduoli
pushed a commit
that referenced
this pull request
Aug 22, 2025
* ✨ (authContext.tsx): Add setCookieWithOptions function to set cookies with specific options for better security and control 📝 (use-post-refresh-access.ts): Update cookies.set calls to use setCookieWithOptions function for consistent cookie settings ♻️ (utils.ts): Refactor setCookieWithOptions function to include httpOnly option and update sameSite values to lowercase for consistency * 📝 (frontend): add useGetCookieAuth and useSetCookieAuth hooks for managing cookies in auth context 🔧 (frontend): refactor authStore to use new cookie hooks for managing access token and api key cookies 🔧 (frontend): refactor use-post-logout and use-post-refresh-access to use new cookie hooks for cookie management * 📝 (frontend): Remove redundant useGetCookieAuth hook and use direct access to cookies in authStore and related components 🔧 (utils): Refactor getAuthCookie and setAuthCookie functions to use react-cookie directly for better code organization and readability
lucaseduoli
pushed a commit
that referenced
this pull request
Aug 25, 2025
* ✨ (authContext.tsx): Add setCookieWithOptions function to set cookies with specific options for better security and control 📝 (use-post-refresh-access.ts): Update cookies.set calls to use setCookieWithOptions function for consistent cookie settings ♻️ (utils.ts): Refactor setCookieWithOptions function to include httpOnly option and update sameSite values to lowercase for consistency * 📝 (frontend): add useGetCookieAuth and useSetCookieAuth hooks for managing cookies in auth context 🔧 (frontend): refactor authStore to use new cookie hooks for managing access token and api key cookies 🔧 (frontend): refactor use-post-logout and use-post-refresh-access to use new cookie hooks for cookie management * 📝 (frontend): Remove redundant useGetCookieAuth hook and use direct access to cookies in authStore and related components 🔧 (utils): Refactor getAuthCookie and setAuthCookie functions to use react-cookie directly for better code organization and readability
13ph03nix
added a commit
to 13ph03nix/langflow
that referenced
this pull request
Oct 6, 2025
Change REFRESH_SAME_SITE default from 'none' to 'strict' to prevent cross-origin requests from including the refresh token cookie. Previous frontend cookie security improvements in langflow-ai#9240 had no effect on httpOnly cookies, which must be configured in backend settings. This change prevents potential CSRF attacks and session hijacking when combined with permissive CORS configurations.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces a utility function to standardize cookie settings and updates the codebase to use it, along with minor improvements to code formatting and type definitions. The most important changes are grouped below:
Cookie Handling Updates:
setCookieWithOptions, insrc/utils/utils.tsto centralize and standardize cookie options (path,secure,sameSite).src/contexts/authContext.tsxandsrc/controllers/API/queries/auth/use-post-refresh-access.tsto usesetCookieWithOptionsfor consistency. [1] [2]Type and Interface Enhancements:
CookieOptionsinterface insrc/utils/utils.tsto include a newhttpOnlyproperty and updated thesameSiteproperty to use lowercase values for better compatibility.Code Formatting:
brokenEdgeMessagefunction insrc/utils/utils.tsby reformatting a complex string template.Summary by CodeRabbit