From 78be1d6fc50be3dc31e25399b04438587404aaf2 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Tue, 24 Jan 2023 14:53:57 +0800
Subject: [PATCH] core: remove outdated session.secure option

---
 packages/hydrooj/src/interface.ts           | 1 -
 packages/hydrooj/src/model/setting.ts       | 1 -
 packages/hydrooj/src/service/layers/base.ts | 3 +--
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/packages/hydrooj/src/interface.ts b/packages/hydrooj/src/interface.ts
index e2adb7e3c..f3274a6e8 100644
--- a/packages/hydrooj/src/interface.ts
+++ b/packages/hydrooj/src/interface.ts
@@ -32,7 +32,6 @@ export interface SystemKeys {
     'limit.problem_files_max': number,
     'problem.categories': string,
     'session.keys': string[],
-    'session.secure': boolean,
     'session.saved_expire_seconds': number,
     'session.unsaved_expire_seconds': number,
     'user.quota': number,
diff --git a/packages/hydrooj/src/model/setting.ts b/packages/hydrooj/src/model/setting.ts
index a9cf3329d..c3c2be41c 100644
--- a/packages/hydrooj/src/model/setting.ts
+++ b/packages/hydrooj/src/model/setting.ts
@@ -232,7 +232,6 @@ SystemSetting(
     Setting('setting_basic', 'pagination.training', 10, 'number', 'pagination.training', 'Trainings per page'),
     Setting('setting_basic', 'pagination.reply', 50, 'number', 'pagination.reply', 'Replies per page'),
     Setting('setting_session', 'session.keys', [String.random(32)], 'text', 'session.keys', 'session.keys', FLAG_HIDDEN),
-    Setting('setting_session', 'session.secure', false, 'boolean', 'session.secure', 'session.secure', FLAG_HIDDEN),
     Setting('setting_session', 'session.domain', '', 'text', 'session.domain', 'session.domain', FLAG_HIDDEN),
     Setting('setting_session', 'session.saved_expire_seconds', 3600 * 24 * 30,
         'number', 'session.saved_expire_seconds', 'Saved session expire seconds'),
diff --git a/packages/hydrooj/src/service/layers/base.ts b/packages/hydrooj/src/service/layers/base.ts
index c7663e619..fd304f220 100644
--- a/packages/hydrooj/src/service/layers/base.ts
+++ b/packages/hydrooj/src/service/layers/base.ts
@@ -75,10 +75,9 @@ export default async (ctx: KoaContext, next: Next) => {
     if (!request.websocket) {
         const options: any = {
             expires: new Date(Date.now() + expireSeconds * 1000),
-            secure: !!system.get('session.secure'),
             httpOnly: false,
         };
-        if (system.get('session.domain')) {
+        if (system.get('session.domain') && ctx.request.secure && ctx.request.host.endsWith(system.get('session.domain'))) {
             options.domain = system.get('session.domain');
             options.sameSite = 'none';
             options.secure = true;