Merge branch '3.2-fixes'

server/config/config.example.js

@@ -50,6 +50,12 @@ module.exports =
 	// listeningRedirectPort disabled
 	// use case: loadbalancer backend
 	httpOnly              : false,
+	// WebServer/Express trust proxy config for httpOnly mode
+	// You can find more info:
+	//  - https://expressjs.com/en/guide/behind-proxies.html
+	//  - https://www.npmjs.com/package/proxy-addr
+	// use case: loadbalancer backend
+    trustProxy           : '',
 	// If this is set to true, only signed-in users will be able
 	// to join a room directly. Non-signed-in users (guests) will
 	// always be put in the lobby regardless of room lock status.

server/lib/Room.js

@@ -472,7 +472,7 @@ class Room extends EventEmitter
 					.filter((joinedPeer) => joinedPeer.id !== peer.id)
 					.map((joinedPeer) => (joinedPeer.peerInfo));
 
-				cb(null, { peers: peerInfos });
+				cb(null, { peers: peerInfos, authenticated: peer.authenticated });
 
 				// Mark the new Peer as joined.
 				peer.joined = true;

server/server.js

@@ -99,6 +99,10 @@ const session = expressSession({
 	}
 });
 
+if (config.trustProxy) {
+	app.set('trust proxy', config.trustProxy);
+}
+
 app.use(session);
 
 passport.serializeUser((user, done) =>
@@ -167,7 +171,7 @@ function setupLTI(ltiConfig)
 
 	const ltiStrategy = new LTIStrategy(
 		ltiConfig,
-		function(req, lti, done)
+		(req, lti, done) =>
 		{
 			// LTI launch parameters
 			if (lti)
@@ -332,7 +336,7 @@ async function setupAuth()
 	// lti launch
 	app.post('/auth/lti',
 		passport.authenticate('lti', { failureRedirect: '/' }),
-		function(req, res)
+		(req, res) =>
 		{
 			res.redirect(`/${req.user.room}`);
 		}
@@ -342,7 +346,7 @@ async function setupAuth()
 	app.get('/auth/logout', (req, res) =>
 	{
 		req.logout();
-		res.send(logoutHelper());
+		req.session.destroy(() => res.send(logoutHelper()));
 	});
 
 	// callback
@@ -391,7 +395,7 @@ async function runHttpsServer()
 
 	app.all('*', async (req, res, next) =>
 	{
-		if (req.secure)
+		if (req.secure || config.httpOnly )
 		{
 			const ltiURL = new URL(`${req.protocol }://${ req.get('host') }${req.originalUrl}`);