xTr1m/GameList
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch to signed cookie auth and stop leaking player IDs

Browse Source
This commit is contained in:
Frank Tovar
2026-02-05 16:28:22 +01:00
parent 67453d0756
commit a6265e8656
12 changed files with 100 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Endpoints/AuthEndpoints.cs
View File

@@ -3,7 +3,6 @@ using GameList.Data;
using GameList.Domain;
using GameList.Infrastructure;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http;
using Microsoft.EntityFrameworkCore;
namespace GameList.Endpoints;
@@ -59,7 +58,7 @@ public static class AuthEndpoints
db.Players.Add(player);
await db.SaveChangesAsync();
PlayerIdentityExtensions.IssuePlayerCookie(ctx, player.Id, player.Username);
await PlayerIdentityExtensions.SignInPlayerAsync(ctx, player);
return Results.Ok(new { player.Id, player.Username, player.DisplayName, player.IsAdmin });
});
@@ -84,14 +83,14 @@ public static class AuthEndpoints
player.LastLoginAt = DateTimeOffset.UtcNow;
await db.SaveChangesAsync();
PlayerIdentityExtensions.IssuePlayerCookie(ctx, player.Id, player.Username);
await PlayerIdentityExtensions.SignInPlayerAsync(ctx, player);
return Results.Ok(new { player.Id, player.Username, player.DisplayName, player.IsAdmin });
});
group.MapPost("/logout", (HttpContext ctx) =>
group.MapPost("/logout", async (HttpContext ctx) =>
{
PlayerIdentityExtensions.ClearPlayerCookie(ctx);
await PlayerIdentityExtensions.SignOutPlayerAsync(ctx);
return Results.NoContent();
});
}