Minor refactor: Move "samesite" cookie handling to vndb.pl

As its now being used from two distinct places.

1 files changed, 7 insertions, 0 deletions

diff --git a/util/vndb.pl b/util/vndb.pl
index 0741bfaf..b7aedb27 100755
--- a/util/vndb.pl
+++ b/util/vndb.pl
@@ -50,6 +50,9 @@ sub TUWF::Object::imgpath { _path $ROOT, $_[1], $_[2] }
 # tuwf->imgurl($image_id, $thumb)
 sub TUWF::Object::imgurl { _path $_[0]{url_static}, $_[1], $_[2] }
 
+# tuwf->samesite() - returns true if this request originated from the same site, i.e. not an external referer.
+sub TUWF::Object::samesite { !!tuwf->reqCookie('samesite') }
+
 
 TUWF::hook before => sub {
     # If we're running standalone, serve www/ and static/ too.
@@ -60,6 +63,10 @@ TUWF::hook before => sub {
         }
     }
 
+    # Use a 'SameSite=Strict' cookie to determine whether this page was loaded from internal or external.
+    # Ought to be more reliable than checking the Referer header, but it's unfortunately a bit uglier.
+    tuwf->resCookie(samesite => 1, httponly => 1, samesite => 'Strict') if !tuwf->samesite;
+
     # load some stats (used for about all pageviews, anyway)
     tuwf->{stats} = tuwf->dbStats;
 };