Fix cookie settings for HTTP deployment

- Remove __Secure- prefix for non-HTTPS
- Set secure: false to allow cookies over HTTP
- Enables session persistence in Docker deployment
This commit is contained in:
2025-12-02 13:19:30 +00:00
parent f3d9ccde56
commit 9bd4dfe0e1

View File

@@ -9,12 +9,12 @@ export const authConfig = {
},
cookies: {
sessionToken: {
name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
name: 'next-auth.session-token',
options: {
httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
path: '/',
secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
secure: false, // Set to false for HTTP, true only if using HTTPS
},
},
},