Fix cookie settings for HTTP deployment
- Remove __Secure- prefix for non-HTTPS - Set secure: false to allow cookies over HTTP - Enables session persistence in Docker deployment
This commit is contained in:
@@ -9,12 +9,12 @@ export const authConfig = {
|
|||||||
},
|
},
|
||||||
cookies: {
|
cookies: {
|
||||||
sessionToken: {
|
sessionToken: {
|
||||||
name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`,
|
name: 'next-auth.session-token',
|
||||||
options: {
|
options: {
|
||||||
httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
|
httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
|
||||||
sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
|
sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
|
||||||
path: '/',
|
path: '/',
|
||||||
secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production
|
secure: false, // Set to false for HTTP, true only if using HTTPS
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
|||||||
Reference in New Issue
Block a user