diff --git a/packages/nextjs/src/config/constants.ts b/packages/nextjs/src/config/constants.ts index b33fec9f..2832f204 100644 --- a/packages/nextjs/src/config/constants.ts +++ b/packages/nextjs/src/config/constants.ts @@ -76,6 +76,12 @@ export enum EnvVariables { */ FRONTEGG_COOKIE_DOMAIN = 'FRONTEGG_COOKIE_DOMAIN', + /** + * The stateless cookie same site value for storing the encrypted JWT + * default is none, you can set it to 'lax' or 'strict' for more security + */ + FRONTEGG_COOKIE_SAME_SITE = 'FRONTEGG_COOKIE_SAME_SITE', + /** * When `true`, the initial props will not refresh access token if it's valid. */ diff --git a/packages/nextjs/src/config/index.ts b/packages/nextjs/src/config/index.ts index 5ad5e9ea..58d96532 100644 --- a/packages/nextjs/src/config/index.ts +++ b/packages/nextjs/src/config/index.ts @@ -16,6 +16,7 @@ const setupEnvVariables = { FRONTEGG_ENCRYPTION_PASSWORD: process.env.FRONTEGG_ENCRYPTION_PASSWORD, FRONTEGG_COOKIE_NAME: process.env.FRONTEGG_COOKIE_NAME, FRONTEGG_COOKIE_DOMAIN: process.env.FRONTEGG_COOKIE_DOMAIN, + FRONTEGG_COOKIE_SAME_SITE: process.env.FRONTEGG_COOKIE_SAME_SITE, FRONTEGG_JWT_PUBLIC_KEY: process.env.FRONTEGG_JWT_PUBLIC_KEY, FRONTEGG_SECURE_JWT_ENABLED: process.env.FRONTEGG_SECURE_JWT_ENABLED, DISABLE_INITIAL_PROPS_REFRESH_TOKEN: process.env.DISABLE_INITIAL_PROPS_REFRESH_TOKEN, @@ -117,6 +118,25 @@ class Config { ); } + get cookieSameSite(): 'lax' | 'strict' | 'none' { + let sameSite = getEnvOrDefault( + EnvVariables.FRONTEGG_COOKIE_SAME_SITE, + setupEnvVariables.FRONTEGG_COOKIE_SAME_SITE ?? 'none' + ); + switch (sameSite) { + case 'true': + return 'strict'; + case 'false': + return 'none'; + case 'lax': + case 'strict': + case 'none': + return sameSite; + default: + return 'none'; + } + } + get authRoutes(): Partial { return this.fronteggAppOptions?.authOptions?.routes ?? {}; } diff --git a/packages/nextjs/src/utils/cookies/index.ts b/packages/nextjs/src/utils/cookies/index.ts index c73ed08a..b3913497 100644 --- a/packages/nextjs/src/utils/cookies/index.ts +++ b/packages/nextjs/src/utils/cookies/index.ts @@ -67,7 +67,7 @@ class CookieManager { if (options.secure) { logger.debug(`Set cookie '${cookieName}' as secure`); serializeOptions.secure = options.secure; - serializeOptions.sameSite = 'none'; + serializeOptions.sameSite = config.cookieSameSite; } const serializedCookie = cookieSerializer.serialize(cookieName, cookieValue, serializeOptions);