Default auth cookies to non-secure for HTTP installs

2025-09-18 16:47:48 +02:00
parent e51347d0a1
commit 8c77b30de6
1 changed files with 8 additions and 1 deletions
@@ -4,7 +4,14 @@ const GALLERY_COOKIE_PREFIX = 'gallery_token_';

 const DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours

-const secureCookie = process.env.COOKIE_SECURE === 'true' || process.env.NODE_ENV === 'production';
+const secureCookie = (() => {
+  if (typeof process.env.COOKIE_SECURE === 'string') {
+    return process.env.COOKIE_SECURE.toLowerCase() === 'true';
+  }
+  // Default to false so native HTTP installs stay functional. Operators can
+  // opt-in via COOKIE_SECURE=true when serving behind HTTPS.
+  return false;
+})();
 const sameSiteDefault = process.env.COOKIE_SAMESITE || 'Lax';
 const cookieDomain = process.env.COOKIE_DOMAIN;