From 8c77b30de6e3d0c104be484238fa8ecf6814d65b Mon Sep 17 00:00:00 2001 From: paul Date: Thu, 18 Sep 2025 16:47:48 +0200 Subject: [PATCH] Default auth cookies to non-secure for HTTP installs --- backend/src/utils/tokenUtils.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/backend/src/utils/tokenUtils.js b/backend/src/utils/tokenUtils.js index 80059b1..4207faa 100644 --- a/backend/src/utils/tokenUtils.js +++ b/backend/src/utils/tokenUtils.js @@ -4,7 +4,14 @@ const GALLERY_COOKIE_PREFIX = 'gallery_token_'; const DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours -const secureCookie = process.env.COOKIE_SECURE === 'true' || process.env.NODE_ENV === 'production'; +const secureCookie = (() => { + if (typeof process.env.COOKIE_SECURE === 'string') { + return process.env.COOKIE_SECURE.toLowerCase() === 'true'; + } + // Default to false so native HTTP installs stay functional. Operators can + // opt-in via COOKIE_SECURE=true when serving behind HTTPS. + return false; +})(); const sameSiteDefault = process.env.COOKIE_SAMESITE || 'Lax'; const cookieDomain = process.env.COOKIE_DOMAIN;