ac/ac-platform-php
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-platform-php synced 2026-07-29 02:18:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix session cookie secure flag behind TLS-terminating FE proxy.

Browse Source 
Treat apps.f0xx.org and sibling public vhosts as HTTPS when PHP sees plain HTTP on port 80.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-07-08 14:55:28 +02:00
parent e482d56ef5
commit 698fbd7658
1 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
platform/shared_session.php
View File

@@ -5,20 +5,36 @@ declare(strict_types=1);
* Shared session for all Android Cast web consoles (crashes, build, …).
* Same cookie path + session name => one login across sub-apps.
*/
function platform_is_https_request(): bool
{
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
return true;
}
$fwd = strtolower(trim((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')));
if ($fwd === 'https') {
return true;
}
$front = strtolower(trim((string) ($_SERVER['HTTP_FRONT_END_HTTPS'] ?? '')));
if ($front === 'on') {
return true;
}
// Public vhosts are TLS-terminated at the FE; upstream PHP only sees HTTP :80.
$host = strtolower(preg_replace('/:\d+$/', '', (string) ($_SERVER['HTTP_HOST'] ?? '')));
return in_array($host, ['apps.f0xx.org', 's.f0xx.org', 'notify.f0xx.org'], true);
}
function platform_start_session(string $sessionName = 'ac_crash_sess', string $cookiePath = '/app/androidcast_project'): void
{
if (session_status() === PHP_SESSION_ACTIVE) {
return;
}
session_name($sessionName);
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
|| strtolower((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')) === 'https';
session_set_cookie_params([
'lifetime' => 0,
'path' => $cookiePath,
'httponly' => true,
'samesite' => 'Lax',
'secure' => $secure,
'secure' => platform_is_https_request(),
]);
session_start();
}