fixed permission denied page and logout

Author: paynejacob

pkg/auth/service.go

@@ -176,6 +176,7 @@ func (s *Service) callback(w http.ResponseWriter, r *http.Request) {
 		Expires:  newToken.ExpiresAt,
 		Secure:   true,
 		Path:     "/",
+		HttpOnly: true,
 		SameSite: http.SameSiteStrictMode,
 	}
 
@@ -344,18 +345,21 @@ func (s *Service) listProviders(w http.ResponseWriter, _ *http.Request) {
 
 // Logout
 func (s *Service) logout(w http.ResponseWriter, r *http.Request) {
+	token := s.TokenProvider.FromRequest(r)
+
+	if token != nil && s.TokenProvider.Delete(token) != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+	}
+
 	cookie := &http.Cookie{
 		Name:     cookieName,
+		Secure:   true,
+		Path:     "/",
+		HttpOnly: true,
 		SameSite: http.SameSiteStrictMode,
 	}
 
 	http.SetCookie(w, cookie)
 
-	token := s.TokenProvider.FromRequest(r)
-
-	if token != nil && s.TokenProvider.Delete(token) != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-	}
-
 	w.WriteHeader(http.StatusNoContent)
 }

web/speakerbob/src/components/UserMenu.vue

@@ -10,7 +10,7 @@
         <v-list-item-title>Preferences</v-list-item-title>
       </v-list-item>
       <v-spacer />
-      <v-list-item @click="goto('logout')">
+      <v-list-item @click="logout">
         <v-list-item-title>Logout</v-list-item-title>
       </v-list-item>
     </v-list>
@@ -20,25 +20,35 @@
 <script lang="ts">
 import { Vue, Component } from 'vue-property-decorator'
 import { UserPreferences } from '@/definitions/userpreferences'
+import axios from 'axios'
 
 @Component
 export default class UserMenu extends Vue {
   public disabled = false
   public user: UserPreferences = new UserPreferences();
 
   public async created () {
-    const resp = await this.$auth.get('/user/preferences/')
-
-    if (resp.status === 404) {
-      this.disabled = true
-      return
+    try {
+      const resp = await axios.get('/auth/user/preferences/')
+      this.user = resp.data
+    } catch (e) {
+      if (axios.isAxiosError(e)) {
+        if (!!e.response && (e.response.status === 404 || e.response.status === 401)) {
+          this.disabled = true
+          return
+        }
+      }
+      throw e
     }
-
-    this.user = resp.data
   }
 
   private async goto (path: string) {
     await this.$router.push(path)
   }
+
+  private logout () {
+    this.disabled = true
+    this.goto('logout')
+  }
 }
 </script>