Fix cookie settings for HTTP deployment
- Remove __Secure- prefix for non-HTTPS - Set secure: false to allow cookies over HTTP - Enables session persistence in Docker deployment
This commit is contained in:
@@ -9,12 +9,12 @@ export const authConfig = {
|
||||
},
|
||||
cookies: {
|
||||
sessionToken: {
|
||||
name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
|
||||
name: 'next-auth.session-token',
|
||||
options: {
|
||||
httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
|
||||
sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
|
||||
path: '/',
|
||||
secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
|
||||
secure: false, // Set to false for HTTP, true only if using HTTPS
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user