Add "Secure" flag to all cookies (#3301)

* Add "Secure" flag to all cookies

Resolves #3296

* more fixes

configs/app/app.ts

@@ -21,7 +21,7 @@ const app = Object.freeze({
   isDev,
   isReview,
   isPw,
-  protocol: appSchema,
+  protocol: appSchema || 'https',
   host: appHost,
   port: appPort,
   baseUrl,

lib/cookies.ts

@@ -1,5 +1,6 @@
 import Cookies from 'js-cookie';
 
+import config from 'configs/app';
 import { isBrowser } from 'toolkit/utils/isBrowser';
 
 /**
@@ -40,6 +41,11 @@ export const PRIVATE_MODE_DISALLOWED: ReadonlyArray<NAMES> = [
   NAMES.MIXPANEL_DEBUG,
 ];
 
+export const getDefaultAttributes = () => ({
+  path: '/',
+  secure: config.app.protocol === 'https',
+});
+
 export function get(name?: NAMES | undefined | null, serverCookie?: string) {
   if (!isBrowser()) {
     return serverCookie ? getFromCookieString(serverCookie, name) : undefined;
@@ -72,13 +78,11 @@ export function set(name: NAMES, value: string, attributes: Cookies.CookieAttrib
     return;
   }
 
-  attributes.path = '/';
-
-  return Cookies.set(name, value, attributes);
+  return Cookies.set(name, value, { ...getDefaultAttributes(), ...attributes });
 }
 
 export function remove(name: NAMES, attributes: Cookies.CookieAttributes = {}) {
-  return Cookies.remove(name, attributes);
+  return Cookies.remove(name, { ...getDefaultAttributes(), ...attributes });
 }
 
 export function getFromCookieString(cookieString: string, name?: NAMES | undefined | null) {

nextjs/getServerSideProps/handlers.ts

@@ -42,7 +42,7 @@ Promise<GetServerSidePropsResult<Props<Pathname>>> => {
   let uuid = cookies.getFromCookieString(req.headers.cookie || '', cookies.NAMES.UUID);
   if (!uuid && appProfile !== 'private') {
     uuid = crypto.randomUUID();
-    res.setHeader('Set-Cookie', `${ cookies.NAMES.UUID }=${ uuid }`);
+    res.setHeader('Set-Cookie', `${ cookies.NAMES.UUID }=${ uuid }; Path=/${ config.app.protocol === 'https' ? '; Secure' : '' }`);
   }
 
   const isTrackingDisabled = process.env.DISABLE_TRACKING === 'true' || appProfile === 'private';

nextjs/middlewares/addressFormat.ts

@@ -12,9 +12,9 @@ export default function addressFormatMiddleware(req: NextRequest, res: NextRespo
   if (addressFormatCookie) {
     const isValidCookie = config.UI.views.address.hashFormat.availableFormats.includes(addressFormatCookie.value as AddressFormat);
     if (!isValidCookie) {
-      res.cookies.set(cookiesLib.NAMES.ADDRESS_FORMAT, defaultFormat, { path: '/' });
+      res.cookies.set(cookiesLib.NAMES.ADDRESS_FORMAT, defaultFormat, cookiesLib.getDefaultAttributes());
     }
   } else {
-    res.cookies.set(cookiesLib.NAMES.ADDRESS_FORMAT, defaultFormat, { path: '/' });
+    res.cookies.set(cookiesLib.NAMES.ADDRESS_FORMAT, defaultFormat, cookiesLib.getDefaultAttributes());
   }
 }

nextjs/middlewares/appProfile.ts

@@ -13,8 +13,11 @@ export default function appProfileMiddleware(req: NextRequest, res: NextResponse
 
   const profileValue = headerValue || queryValue;
   if (profileValue === PRIVATE_PROFILE_VALUE) {
-    res.cookies.set(cookiesLib.NAMES.APP_PROFILE, PRIVATE_PROFILE_VALUE, { path: '/' });
+    res.cookies.set(cookiesLib.NAMES.APP_PROFILE, PRIVATE_PROFILE_VALUE, cookiesLib.getDefaultAttributes());
   } else {
-    res.cookies.delete(cookiesLib.NAMES.APP_PROFILE);
+    res.cookies.delete({
+      name: cookiesLib.NAMES.APP_PROFILE,
+      ...cookiesLib.getDefaultAttributes(),
+    });
   }
 }

nextjs/middlewares/colorTheme.ts

@@ -8,8 +8,8 @@ export default function colorThemeMiddleware(req: NextRequest, res: NextResponse
 
   if (!colorModeCookie) {
     if (appConfig.UI.colorTheme.default) {
-      res.cookies.set(cookiesLib.NAMES.COLOR_MODE, appConfig.UI.colorTheme.default.colorMode, { path: '/' });
-      res.cookies.set(cookiesLib.NAMES.COLOR_THEME, appConfig.UI.colorTheme.default.id, { path: '/' });
+      res.cookies.set(cookiesLib.NAMES.COLOR_MODE, appConfig.UI.colorTheme.default.colorMode, cookiesLib.getDefaultAttributes());
+      res.cookies.set(cookiesLib.NAMES.COLOR_THEME, appConfig.UI.colorTheme.default.id, cookiesLib.getDefaultAttributes());
     }
   }
 }

nextjs/middlewares/poorReputationTokens.ts

@@ -8,7 +8,7 @@ export default function poorReputationTokensMiddleware(req: NextRequest, res: Ne
     const showPoorReputationTokensCookie = req.cookies.get(cookiesLib.NAMES.SHOW_POOR_REPUTATION_TOKENS);
 
     if (!showPoorReputationTokensCookie) {
-      res.cookies.set(cookiesLib.NAMES.SHOW_POOR_REPUTATION_TOKENS, 'false', { path: '/' });
+      res.cookies.set(cookiesLib.NAMES.SHOW_POOR_REPUTATION_TOKENS, 'false', cookiesLib.getDefaultAttributes());
     }
   }
 }

nextjs/middlewares/scamTokens.ts

@@ -8,7 +8,7 @@ export default function scamTokensMiddleware(req: NextRequest, res: NextResponse
     const showScamTokensCookie = req.cookies.get(cookiesLib.NAMES.SHOW_SCAM_TOKENS);
 
     if (!showScamTokensCookie) {
-      res.cookies.set(cookiesLib.NAMES.SHOW_SCAM_TOKENS, 'false', { path: '/' });
+      res.cookies.set(cookiesLib.NAMES.SHOW_SCAM_TOKENS, 'false', cookiesLib.getDefaultAttributes());
     }
   }
 }