diff --git a/src/metabase/handler.clj b/src/metabase/handler.clj index 6d81b9f0fb643270d1011ea4b4fd539b02b5f569..d82c3ded88dbc6ef07ff5f7ce4a31c57ae884438 100644 --- a/src/metabase/handler.clj +++ b/src/metabase/handler.clj @@ -37,7 +37,6 @@ mw.auth/wrap-api-key ; looks for a Metabase API Key on the request and assocs as :metabase-api-key mw.misc/maybe-set-site-url ; set the value of `site-url` if it hasn't been set yet ;; Disabled for now because some things like CSV download buttons don't work with this on. - #_mw.json/check-application-type-headers ; Reject non-GET requests without Content-Type: application/json headers, we don't support them mw.misc/bind-user-locale ; Binds *locale* for i18n wrap-cookies ; Parses cookies in the request map and assocs as :cookies mw.misc/add-content-type ; Adds a Content-Type header for any response that doesn't already have one diff --git a/src/metabase/middleware/session.clj b/src/metabase/middleware/session.clj index b49e2f814aad1d47f78a57fab4596f741fc50f4d..b45d0d57d2612382b7eee2fcb0d7e9d952d4059c 100644 --- a/src/metabase/middleware/session.clj +++ b/src/metabase/middleware/session.clj @@ -32,7 +32,7 @@ (def ^:private ^String metabase-session-header "x-metabase-session") (defn- clear-cookie [response cookie-name] - (resp/set-cookie response cookie-name nil {:expires (DateTime. 0)})) + (resp/set-cookie response cookie-name nil {:expires (DateTime. 0), :path "/"})) (defn- wrap-body-if-needed "You can't add a cookie (by setting the `:cookies` key of a response) if the response is an unwrapped JSON response; @@ -77,13 +77,14 @@ (-> response wrap-body-if-needed (clear-cookie metabase-legacy-session-cookie) - ;; See also https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie + ;; See also https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie and `ring.middleware.cookies` (resp/set-cookie metabase-session-cookie (str session-id) (merge {:same-site :lax :http-only true + :path "/" ;; max-session age-is in minutes; Max-Age= directive should be in seconds :max-age (* 60 (config/config-int :max-session-age))} ;; If the authentication request request was made over HTTPS (hopefully always except for local dev instances) diff --git a/test/metabase/test/util/async.clj b/test/metabase/test/util/async.clj index c3d413d9a909b6854707b0d1f772f69f8a5778f7..f7109310f577cfa334e44d13e4d5391525289796 100644 --- a/test/metabase/test/util/async.clj +++ b/test/metabase/test/util/async.clj @@ -16,8 +16,10 @@ (throw (TimeoutException. "Timed out.")) :else - (throw (ex-info "Waiting for channel to close, but got unexpected result" - {:result result}))))) + (do + (println "Waiting for channel to close, but got unexpected result:" result) + (throw (ex-info "Waiting for channel to close, but got unexpected result" + {:result result})))))) (defmacro with-open-channels "Like `with-open`, but closes core.async channels at the conclusion of `body`."