From 359d4369e8c361db44e1d76ba20b2b8a8f69fc58 Mon Sep 17 00:00:00 2001 From: Dasemu Date: Thu, 8 Oct 2026 04:25:06 +0200 Subject: [PATCH] fix: session cookie secure flag was never true-to-request MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cookie.secure was tied to NODE_ENV=production instead of whether the request actually arrived over HTTPS, so in a production build the admin login cookie was never stored at all when accessed over plain HTTP (e.g. direct container access, or a proxy that doesn't terminate TLS in front of the admin panel) — confirmed while deploying to production, login returned 200 but no session persisted. "auto" uses req.secure via the existing trust-proxy setting instead. Co-Authored-By: Claude Sonnet 5 --- apps/server/src/index.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/apps/server/src/index.ts b/apps/server/src/index.ts index 3aa669c..9d220e6 100644 --- a/apps/server/src/index.ts +++ b/apps/server/src/index.ts @@ -22,7 +22,12 @@ app.use( saveUninitialized: false, cookie: { httpOnly: true, - secure: process.env.NODE_ENV === "production", + // "auto": secure only if the request actually arrived over HTTPS (checks req.secure, + // which respects "trust proxy" + X-Forwarded-Proto). A flat `NODE_ENV === "production"` + // check meant the cookie was never stored at all when the admin panel is reached over + // plain HTTP (e.g. direct to the container, or behind a proxy that doesn't terminate TLS + // for it) — login would silently "succeed" but no session would ever persist. + secure: "auto", maxAge: 1000 * 60 * 60 * 12, }, }),