Skip to content

lablink_allocator_service.routes.session_cookie

Signing and setting the lablink_session cookie.

Shared by /api/request_vm (student) and the admin peek/connect routes so the cookie-hardening flags (httponly, samesite, secure) cannot drift apart across call sites.

Sign session_id (optionally with a :suffix) into the lablink_session cookie and redirect to /desktop.

Parameters:

Name Type Description Default
session_id

The session identifier to sign (str or UUID).

 required
suffix str

Optional payload suffix (e.g. "view_only", "admin_session"). Omitted entirely for a bare student session.

 ''
Source code in packages/allocator/src/lablink_allocator_service/routes/session_cookie.py 
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
def sign_session_cookie_and_redirect(
    session_id, *, suffix: str = ""
) -> Response:
    """Sign ``session_id`` (optionally with a ``:suffix``) into the
    lablink_session cookie and redirect to /desktop.

    Args:
        session_id: The session identifier to sign (str or UUID).
        suffix: Optional payload suffix (e.g. "view_only", "admin_session").
            Omitted entirely for a bare student session.
    """
    from lablink_allocator_service import main

    conn = main.database._pool.getconn()
    try:
        secret = get_or_create_cookie_secret(conn)
    finally:
        main.database._pool.putconn(conn)

    payload = f"{session_id}:{suffix}" if suffix else str(session_id)
    signed = sign(payload, secret=secret)
    resp = redirect("/desktop", code=303)
    # Secure flag is decided by whether the inbound request was https —
    # front door (ALB/Caddy/Cloudflare) sets X-Forwarded-Proto.
    is_https = request.headers.get("X-Forwarded-Proto") == "https"
    resp.set_cookie(
        "lablink_session", signed,
        httponly=True, samesite="Strict",
        secure=is_https, path="/",
    )
    return resp