A lexicon-driven AppView for ATProto.
happyview.dev
backfill
firehose
jetstream
atproto
appview
oauth
lexicon
fix: allow HappyView redirect cookie to be read appropriately
+3
-4
+3
-4
src/auth/routes.rs
+3
-4
src/auth/routes.rs
···
47
47
.map_err(|e| AppError::Internal(format!("OAuth authorize failed: {e}")))?;
48
48
49
49
// Store the redirect URI in a cookie if provided
50
+
// Must use SameSite=None for cross-origin requests (e.g., Pentaract calling HappyView)
50
51
let jar = if let Some(redirect_uri) = query.redirect_uri {
51
52
let mut cookie = Cookie::new(REDIRECT_COOKIE_NAME, redirect_uri);
52
53
cookie.set_path("/");
53
54
cookie.set_http_only(true);
54
-
cookie.set_same_site(axum_extra::extract::cookie::SameSite::Lax);
55
-
if state.config.public_url.starts_with("https") {
56
-
cookie.set_secure(true);
57
-
}
55
+
cookie.set_same_site(axum_extra::extract::cookie::SameSite::None);
56
+
cookie.set_secure(true); // Required when SameSite=None
58
57
jar.add(cookie)
59
58
} else {
60
59
jar