Joseph Doherty 579522c586 fix(security): make auth-cookie SecurePolicy configurable for HTTP-only deployments ...

The cookie SecurePolicy was hard-coded to Always, so the auth cookie was always
marked Secure and the browser never sent it over plain HTTP — making login
impossible on the HTTP-only Docker dev cluster (login succeeded server-side but
every following request was unauthenticated). Add SecurityOptions.RequireHttps-
Cookie (default true — production stays HTTPS-only); when false the cookie uses
SameAsRequest. The docker/ central nodes set it false.

2026-05-18 02:34:02 -04:00

1.9 KiB

Raw Blame History

View Raw