jos/stremio
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Do not force Secure cookies in production when site is served over HTTP.

Browse source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jos Vooges | STH 2026-08-25 01:04:47 +02:00
parent 9b557cee54
commit 72a323e451
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
apps/admin-ui/src/app/api/[...path]/route.ts
View file

@ -19,7 +19,7 @@ function candidateBases(): string[] {
function isHttps(request: NextRequest): boolean {
const proto = request.headers.get("x-forwarded-proto");
if (proto) return proto.split(",")[0].trim() === "https";
if (proto) return proto.split(",")[0].trim().toLowerCase() === "https";
return request.nextUrl.protocol === "https:";
}
@ -29,7 +29,9 @@ function applySessionCookie(
request: NextRequest,
expiresAt?: string
) {
const secure = isHttps(request) || process.env.NODE_ENV === "production";
// Only mark Secure when the browser actually used HTTPS.
// NODE_ENV=production alone must NOT force Secure (breaks http://admin...).
const secure = isHttps(request);
response.cookies.set({
name: SESSION_COOKIE,
value: token,
@ -43,7 +45,7 @@ function applySessionCookie(
}
function clearSessionCookie(response: NextResponse, request: NextRequest) {
const secure = isHttps(request) || process.env.NODE_ENV === "production";
const secure = isHttps(request);
response.cookies.set({
name: SESSION_COOKIE,
value: "",