openclaw/oikos
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce Secure flag on session and CSRF cookies by default

Browse Source 
Cookies were sent without Secure flag outside of production (NODE_ENV check).
New logic: secure=true by default; set SESSION_SECURE=false in .env to
allow HTTP explicitly (local dev without reverse proxy). Affects session
cookie, CSRF cookie in login handler, and CSRF middleware.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Ulas
2026-04-01 18:34:31 +02:00
parent 91c2e0ad98
commit 59791df248
3 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/auth.js
+3 -6
View File
@@ -103,10 +103,8 @@ const sessionMiddleware = session({
name: 'oikos.sid',
cookie: {
httpOnly: true,
// SESSION_SECURE=false in .env erlaubt HTTP-Zugriff (z.B. direktes localhost ohne Reverse Proxy)
// Ohne diese Variable: secure=true wenn NODE_ENV=production
secure: process.env.SESSION_SECURE === 'false' ? false
: process.env.NODE_ENV === 'production',
// secure=true by default; set SESSION_SECURE=false in .env to allow HTTP (local dev without reverse proxy)
secure: process.env.SESSION_SECURE !== 'false',
sameSite: 'strict',
maxAge: 1000 * 60 * 60 * 24 * 7, // 7 Tage in ms
},
@@ -193,8 +191,7 @@ router.post('/login', loginLimiter, async (req, res) => {
res.cookie('csrf-token', req.session.csrfToken, {
httpOnly: false,
sameSite: 'strict',
secure: process.env.SESSION_SECURE === 'false' ? false
: process.env.NODE_ENV === 'production',
secure: process.env.SESSION_SECURE !== 'false',
maxAge: 1000 * 60 * 60 * 24 * 7,
});