add setting for secure flag on cookie (#11422)

* add setting for secure flag on cookie

* docs fix

docs/docs/configuration/authentication.md

@@ -18,11 +18,11 @@ Frigate supports two modes for authentication
 
 Frigate stores user information in its database. Password hashes are generated using industry standard PBKDF2-SHA256 with 600,000 iterations. Upon successful login, a JWT token is issued with an expiration date and set as a cookie. The cookie is refreshed as needed automatically. This JWT token can also be passed in the Authorization header as a bearer token.
 
-Users are managed in the UI under Settings > Authentication.
+Users are managed in the UI under Settings > Users.
 
 #### Onboarding
 
-On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time under Settings > Authentication.
+On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time under Settings > Users.
 
 #### Resetting admin password
 

docs/docs/configuration/reference.md

@@ -73,6 +73,9 @@ auth:
  reset_admin_password: False
  # Optional: Cookie to store the JWT token for native auth (default: shown below)
  cookie_name: frigate_token
+ # Optional: Set secure flag on cookie. (default: shown below)
+ # NOTE: This should be set to True if you are using TLS
+ cookie_secure: False
  # Optional: Session length in seconds (default: shown below)
  session_length: 86400 # 24 hours
  # Optional: Refresh time in seconds (default: shown below)

frigate/api/auth.py

@@ -160,10 +160,10 @@ def create_encoded_jwt(user, expiration, secret):
  return jwt.encode({"alg": "HS256"}, {"sub": user, "exp": expiration}, secret)
 
 
-def set_jwt_cookie(response, cookie_name, encoded_jwt, expiration):
+def set_jwt_cookie(response, cookie_name, encoded_jwt, expiration, secure):
  # TODO: ideally this would set secure as well, but that requires TLS
  response.set_cookie(
- cookie_name, encoded_jwt, httponly=True, expires=expiration, secure=False
+ cookie_name, encoded_jwt, httponly=True, expires=expiration, secure=secure
  )
 
 
@@ -196,6 +196,7 @@ def auth():
  fail_response.headers["location"] = "/login"
 
  JWT_COOKIE_NAME = current_app.frigate_config.auth.cookie_name
+ JWT_COOKIE_SECURE = current_app.frigate_config.auth.cookie_secure
  JWT_REFRESH = current_app.frigate_config.auth.refresh_time
  JWT_SESSION_LENGTH = current_app.frigate_config.auth.session_length
 
@@ -256,7 +257,11 @@ def auth():
  user, new_expiration, current_app.jwt_token
  )
  set_jwt_cookie(
- success_response, JWT_COOKIE_NAME, new_encoded_jwt, new_expiration
+ success_response,
+ JWT_COOKIE_NAME,
+ new_encoded_jwt,
+ new_expiration,
+ JWT_COOKIE_SECURE,
  )
 
  success_response.headers["remote-user"] = user
@@ -284,6 +289,7 @@ def logout():
 @limiter.limit(get_rate_limit, deduct_when=lambda response: response.status_code == 400)
 def login():
  JWT_COOKIE_NAME = current_app.frigate_config.auth.cookie_name
+ JWT_COOKIE_SECURE = current_app.frigate_config.auth.cookie_secure
  JWT_SESSION_LENGTH = current_app.frigate_config.auth.session_length
  content = request.get_json()
  user = content["user"]
@@ -299,7 +305,9 @@ def login():
  expiration = int(time.time()) + JWT_SESSION_LENGTH
  encoded_jwt = create_encoded_jwt(user, expiration, current_app.jwt_token)
  response = make_response({}, 200)
- set_jwt_cookie(response, JWT_COOKIE_NAME, encoded_jwt, expiration)
+ set_jwt_cookie(
+ response, JWT_COOKIE_NAME, encoded_jwt, expiration, JWT_COOKIE_SECURE
+ )
  return response
  return make_response({"message": "Login failed"}, 400)
 

frigate/config.py

@@ -135,6 +135,7 @@ class AuthConfig(FrigateBaseModel):
  cookie_name: str = Field(
  default="frigate_token", title="Name for jwt token cookie", pattern=r"^[a-z]_*$"
  )
+ cookie_secure: bool = Field(default=False, title="Set secure flag on cookie")
  session_length: int = Field(
  default=86400, title="Session length for jwt session tokens", ge=60
  )