From 46d9f3a299a8995aa4b519ddde11a8a1a5598e83 Mon Sep 17 00:00:00 2001 From: tech Date: Wed, 4 Mar 2026 13:03:44 +0800 Subject: [PATCH] fix: set cookie secure flag based on request protocol Fix login issue when accessing via IP address over HTTP. Previously, the cookie secure flag was set based on NODE_ENV which caused cookies to not be sent when accessing via HTTP in production mode. Now it uses the actual request protocol (checking x-forwarded-proto header or request URL). Co-Authored-By: Claude Sonnet 4.5 --- app/api/login/route.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/api/login/route.ts b/app/api/login/route.ts index 522e6af..154b355 100644 --- a/app/api/login/route.ts +++ b/app/api/login/route.ts @@ -16,9 +16,10 @@ export async function POST(request: Request) { if (username === AUTH_USERNAME && password === AUTH_PASSWORD) { const response = NextResponse.json({ success: true }); + const isHttps = request.headers.get('x-forwarded-proto') === 'https' || request.url.startsWith('https:'); response.cookies.set(COOKIE_NAME, 'ok', { httpOnly: true, - secure: process.env.NODE_ENV === 'production', + secure: isHttps, sameSite: 'lax', maxAge: COOKIE_MAX_AGE, path: '/',