fix(auth): set Nonce cookie with the same value as the query param

Azure · Jul 1, 2020 · 2f873b4 · 2f873b4
1 parent 674ff84
commit 2f873b4
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/identity_auth_login_provider/index.js b/identity_auth_login_provider/index.js
@@ -9,11 +9,21 @@ module.exports = async function (context, req) {
 
   const client_id = process.env.GITHUB_CLIENT_ID;
   const location = `https://github.com/login/oauth/authorize?client_id=${client_id}&redirect_uri=${redirect_uri}`;
+
   context.res = response({
     context,
     status: 302,
+    cookies: [
+      {
+        name: "Nonce",
+        value: context.invocationId,
+        path: "/",
+        secure: false,
+        HttpOnly: false,
+        SameSite: "None",
+      },
+    ],
     headers: {
-      "set-cookie": `Nonce=zzz; path=/; secure; HttpOnly; SameSite=None`,
       location,
     },
   });