From b43ff3c5ca444ec60587abc0593f609ba9fc65e6 Mon Sep 17 00:00:00 2001 From: Kerim Atilgan Date: Thu, 14 May 2026 21:47:59 +0200 Subject: [PATCH] Use cookie.secure='auto' so login works over HTTP too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cookie was unconditionally Secure in production, which made the browser drop it whenever the app was accessed over plain HTTP (e.g. http://host:3000) — login appeared to succeed but the cookie never came back. 'auto' delegates the decision to express-session based on req.secure, so the same build works for both direct HTTP access and HTTPS-via-proxy setups. Co-Authored-By: Claude Opus 4.7 (1M context) --- server.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/server.js b/server.js index b709627..7cfe02e 100644 --- a/server.js +++ b/server.js @@ -89,7 +89,11 @@ app.use(session({ cookie: { httpOnly: true, sameSite: 'lax', - secure: isProd, + // 'auto' = secure cookie when req.secure is true (HTTPS or trust-proxy + // detected HTTPS), plaintext cookie when accessed over HTTP. Lets the + // same build serve both http://host:3000 and https://host/ without a + // login loop. + secure: 'auto', maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days }, }));