fix: enforce Secure flag on session and CSRF cookies by default

Cookies were sent without Secure flag outside of production (NODE_ENV check).
New logic: secure=true by default; set SESSION_SECURE=false in .env to
allow HTTP explicitly (local dev without reverse proxy). Affects session
cookie, CSRF cookie in login handler, and CSRF middleware.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- Session and CSRF cookies now have `secure: true` by default; HTTP is only allowed when `SESSION_SECURE=false` is explicitly set in `.env` — previously cookies were sent without `Secure` flag in non-production environments
+
 ## [0.5.2] - 2026-04-01
 
 ### Security

server/auth.js

@@ -103,10 +103,8 @@ const sessionMiddleware = session({
   name: 'oikos.sid',
   cookie: {
     httpOnly: true,
-    // SESSION_SECURE=false in .env erlaubt HTTP-Zugriff (z.B. direktes localhost ohne Reverse Proxy)
-    // Ohne diese Variable: secure=true wenn NODE_ENV=production
-    secure: process.env.SESSION_SECURE === 'false' ? false
-          : process.env.NODE_ENV === 'production',
+    // secure=true by default; set SESSION_SECURE=false in .env to allow HTTP (local dev without reverse proxy)
+    secure: process.env.SESSION_SECURE !== 'false',
     sameSite: 'strict',
     maxAge: 1000 * 60 * 60 * 24 * 7, // 7 Tage in ms
   },
@@ -193,8 +191,7 @@ router.post('/login', loginLimiter, async (req, res) => {
       res.cookie('csrf-token', req.session.csrfToken, {
         httpOnly: false,
         sameSite: 'strict',
-        secure: process.env.SESSION_SECURE === 'false' ? false
-              : process.env.NODE_ENV === 'production',
+        secure: process.env.SESSION_SECURE !== 'false',
         maxAge: 1000 * 60 * 60 * 24 * 7,
       });
 

server/middleware/csrf.js

@@ -39,8 +39,7 @@ function csrfMiddleware(req, res, next) {
   res.cookie('csrf-token', req.session.csrfToken, {
     httpOnly: false,
     sameSite: 'strict',
-    secure: process.env.SESSION_SECURE === 'false' ? false
-          : process.env.NODE_ENV === 'production',
+    secure: process.env.SESSION_SECURE !== 'false',
     maxAge: 1000 * 60 * 60 * 24 * 7, // 7 Tage (gleich wie Session)
   });