From 9bd4dfe0e11218622159c5935bbdd4e1a3c4b21e Mon Sep 17 00:00:00 2001
From: Paul Bailey <psbailey31@gmail.com>
Date: Tue, 2 Dec 2025 13:19:30 +0000
Subject: [PATCH] Fix cookie settings for HTTP deployment

- Remove __Secure- prefix for non-HTTPS
- Set secure: false to allow cookies over HTTP
- Enables session persistence in Docker deployment
---
 auth.config.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/auth.config.ts b/auth.config.ts
index 5c021ec..fc749a7 100644
--- a/auth.config.ts
+++ b/auth.config.ts
@@ -9,12 +9,12 @@ export const authConfig = {
   },
   cookies: {
     sessionToken: {
-      name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
+      name: 'next-auth.session-token',
       options: {
         httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
         sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
         path: '/',
-        secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
+        secure: false, // Set to false for HTTP, true only if using HTTPS
       },
     },
   },