jos/stremio
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Do not force Secure cookies in production when site is served over HTTP.

Browse source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jos Vooges | STH 2026-08-25 01:04:47 +02:00
parent 9b557cee54
commit 72a323e451
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
apps/admin-ui/src/app/api/[...path]/route.ts
View file

@ -19,7 +19,7 @@ function candidateBases(): string[] {
function isHttps(request: NextRequest): boolean { function isHttps(request: NextRequest): boolean {
const proto = request.headers.get("x-forwarded-proto"); const proto = request.headers.get("x-forwarded-proto");
if (proto) return proto.split(",")[0].trim() === "https"; if (proto) return proto.split(",")[0].trim().toLowerCase() === "https";
return request.nextUrl.protocol === "https:"; return request.nextUrl.protocol === "https:";
} }
@ -29,7 +29,9 @@ function applySessionCookie(
request: NextRequest, request: NextRequest,
expiresAt?: string expiresAt?: string
) { ) {
const secure = isHttps(request) || process.env.NODE_ENV === "production"; // Only mark Secure when the browser actually used HTTPS.
// NODE_ENV=production alone must NOT force Secure (breaks http://admin...).
const secure = isHttps(request);
response.cookies.set({ response.cookies.set({
name: SESSION_COOKIE, name: SESSION_COOKIE,
value: token, value: token,
@ -43,7 +45,7 @@ function applySessionCookie(
} }
function clearSessionCookie(response: NextResponse, request: NextRequest) { function clearSessionCookie(response: NextResponse, request: NextRequest) {
const secure = isHttps(request) || process.env.NODE_ENV === "production"; const secure = isHttps(request);
response.cookies.set({ response.cookies.set({
name: SESSION_COOKIE, name: SESSION_COOKIE,
value: "", value: "",