From 4733233cae9a9775460cc59db049e9a299a945b8 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Thu, 27 Jul 2017 10:58:12 +1000
Subject: [PATCH] Added new cookie config params

---
 config.js            | 11 ++++++++++-
 services/passport.js | 14 ++++++++++----
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/config.js b/config.js
index 5f43b1c8d..1d12b193e 100644
--- a/config.js
+++ b/config.js
@@ -14,7 +14,7 @@ require('env-rewrite').rewrite();
 const CONFIG = {
 
   // WEBPACK indicates when webpack is currently building.
-  WEBPACK: process.env.WEBPACK === 'true',
+  WEBPACK: process.env.WEBPACK === 'TRUE',
 
   //------------------------------------------------------------------------------
   // JWT based configuration
@@ -24,8 +24,17 @@ const CONFIG = {
   // application.
   JWT_SECRET: process.env.TALK_JWT_SECRET || null,
 
+  // JWT_SECRETS is used when key rotation is available.
   JWT_SECRETS: process.env.TALK_JWT_SECRETS || null,
 
+  // JWT_COOKIE_NAME is the name of the cookie optionally containing the JWT
+  // token.
+  JWT_COOKIE_NAME: process.env.TALK_JWT_COOKIE_NAME || 'authorization',
+
+  // JWT_CLEAR_COOKIE_LOGOUT specifies whether the named cookie should be
+  // cleared when the user is logged out.
+  JWT_CLEAR_COOKIE_LOGOUT: process.env.JWT_CLEAR_COOKIE_LOGOUT ? process.env.JWT_CLEAR_COOKIE_LOGOUT !== 'FALSE' : true,
+
   // JWT_AUDIENCE is the value for the audience claim for the tokens that will be
   // verified when decoding. If `JWT_AUDIENCE` is not in the environment, then it
   // will default to `talk`.
diff --git a/services/passport.js b/services/passport.js
index 81338d75f..542fc9471 100644
--- a/services/passport.js
+++ b/services/passport.js
@@ -21,7 +21,9 @@ const {
   JWT_AUDIENCE,
   JWT_ALG,
   RECAPTCHA_SECRET,
-  RECAPTCHA_ENABLED
+  RECAPTCHA_ENABLED,
+  JWT_COOKIE_NAME,
+  JWT_CLEAR_COOKIE_LOGOUT
 } = require('../config');
 
 const {
@@ -45,7 +47,7 @@ const GenerateToken = (user) => {
 const SetTokenForSafari = (req, res, token) => {
   const browser = bowser._detect(req.headers['user-agent']);
   if (browser.ios || browser.safari) {
-    res.cookie('authorization', token, {
+    res.cookie(JWT_COOKIE_NAME, token, {
       httpOnly: true,
       secure: process.env.NODE_ENV === 'production',
       expires: new Date(Date.now() + ms(JWT_EXPIRY))
@@ -159,7 +161,11 @@ const HandleLogout = (req, res, next) => {
       return next(err);
     }
 
-    res.clearCookie('authorization');
+    // Only clear the cookie on logout if enabled.
+    if (JWT_CLEAR_COOKIE_LOGOUT) {
+      res.clearCookie(JWT_COOKIE_NAME);
+    }
+
     res.status(204).end();
   });
 };
@@ -199,7 +205,7 @@ let cookieExtractor = function(req) {
   let token = null;
 
   if (req && req.cookies) {
-    token = req.cookies['authorization'];
+    token = req.cookies[JWT_COOKIE_NAME];
   }
 
   return token;