Developer/ftdl
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: set cookie secure flag based on request protocol

Browse Source 
Fix login issue when accessing via IP address over HTTP. Previously,
the cookie secure flag was set based on NODE_ENV which caused
cookies to not be sent when accessing via HTTP in production mode.
Now it uses the actual request protocol (checking x-forwarded-proto
header or request URL).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
tech
2026-03-04 13:03:44 +08:00
parent 8227f36cbe
commit 46d9f3a299
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/api/login/route.ts
View File

@@ -16,9 +16,10 @@ export async function POST(request: Request) {
if (username === AUTH_USERNAME && password === AUTH_PASSWORD) { if (username === AUTH_USERNAME && password === AUTH_PASSWORD) {
const response = NextResponse.json({ success: true }); const response = NextResponse.json({ success: true });
const isHttps = request.headers.get('x-forwarded-proto') === 'https' || request.url.startsWith('https:');
response.cookies.set(COOKIE_NAME, 'ok', { response.cookies.set(COOKIE_NAME, 'ok', {
httpOnly: true, httpOnly: true,
secure: process.env.NODE_ENV === 'production', secure: isHttps,
sameSite: 'lax', sameSite: 'lax',
maxAge: COOKIE_MAX_AGE, maxAge: COOKIE_MAX_AGE,
path: '/', path: '/',