From 72a323e451b5334b7523abf663206ae679dc1749 Mon Sep 17 00:00:00 2001 From: Jos Vooges | STH Date: Tue, 25 Aug 2026 01:04:47 +0200 Subject: [PATCH] Do not force Secure cookies in production when site is served over HTTP. Co-authored-by: Cursor --- apps/admin-ui/src/app/api/[...path]/route.ts | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/apps/admin-ui/src/app/api/[...path]/route.ts b/apps/admin-ui/src/app/api/[...path]/route.ts index 06c829b..773fe62 100644 --- a/apps/admin-ui/src/app/api/[...path]/route.ts +++ b/apps/admin-ui/src/app/api/[...path]/route.ts @@ -19,7 +19,7 @@ function candidateBases(): string[] { function isHttps(request: NextRequest): boolean { const proto = request.headers.get("x-forwarded-proto"); - if (proto) return proto.split(",")[0].trim() === "https"; + if (proto) return proto.split(",")[0].trim().toLowerCase() === "https"; return request.nextUrl.protocol === "https:"; } @@ -29,7 +29,9 @@ function applySessionCookie( request: NextRequest, expiresAt?: string ) { - const secure = isHttps(request) || process.env.NODE_ENV === "production"; + // Only mark Secure when the browser actually used HTTPS. + // NODE_ENV=production alone must NOT force Secure (breaks http://admin...). + const secure = isHttps(request); response.cookies.set({ name: SESSION_COOKIE, value: token, @@ -43,7 +45,7 @@ function applySessionCookie( } function clearSessionCookie(response: NextResponse, request: NextRequest) { - const secure = isHttps(request) || process.env.NODE_ENV === "production"; + const secure = isHttps(request); response.cookies.set({ name: SESSION_COOKIE, value: "",