31 lines
936 B
Python
31 lines
936 B
Python
"""Session bootstrap: the one endpoint reachable without a session (US07-02).
|
|
|
|
It sets the ``HttpOnly``/``SameSite=Strict`` session cookie and returns the CSRF
|
|
token in the body. A foreign page can call this — it just cannot read the answer,
|
|
because the app sends no CORS headers — and the cookie it received is never attached
|
|
to a request that foreign page initiates.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from fastapi import APIRouter, Request
|
|
from fastapi.responses import JSONResponse
|
|
|
|
from photo_pipeline.api.security import SESSION_COOKIE
|
|
|
|
router = APIRouter(tags=["session"])
|
|
|
|
|
|
@router.get("/session")
|
|
def start_session(request: Request) -> JSONResponse:
|
|
session = request.app.state.session
|
|
response = JSONResponse({"csrf_token": session.csrf_token})
|
|
response.set_cookie(
|
|
SESSION_COOKIE,
|
|
session.id,
|
|
httponly=True,
|
|
samesite="strict",
|
|
path="/",
|
|
)
|
|
return response
|