Fix cookie settings for HTTP deployment

- Remove __Secure- prefix for non-HTTPS
- Set secure: false to allow cookies over HTTP
- Enables session persistence in Docker deployment
This commit is contained in:
2025-12-02 13:19:30 +00:00
parent f3d9ccde56
commit 9bd4dfe0e1

View File

@@ -9,12 +9,12 @@ export const authConfig = {
}, },
cookies: { cookies: {
sessionToken: { sessionToken: {
name: `${process.env.NODE_ENV === 'production' ? '__Secure-' : ''}next-auth.session-token`, name: 'next-auth.session-token',
options: { options: {
httpOnly: true, // Prevent JavaScript access to cookies (XSS protection) httpOnly: true, // Prevent JavaScript access to cookies (XSS protection)
sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests sameSite: 'lax', // CSRF protection - prevents cookie from being sent in cross-site requests
path: '/', path: '/',
secure: process.env.NODE_ENV === 'production', // Only send cookie over HTTPS in production secure: false, // Set to false for HTTP, true only if using HTTPS
}, },
}, },
}, },