Ulas 35186ca87f fix: change SameSite=Strict to SameSite=Lax for session and CSRF cookies (#46) ...

Safari's ITP blocks Strict cookies on certain navigations (direct URL entry,
reverse proxy context), resulting in a 401 on login even with valid credentials.
Lax is safe: CSRF attacks are prevented by the double-submit token and the
HTTPS-only secure flag. Firefox and Chrome were unaffected.

2026-04-13 21:36:35 +02:00

..

middleware

fix: change SameSite=Strict to SameSite=Lax for session and CSRF cookies (#46)

2026-04-13 21:36:35 +02:00

routes

feat: add French, Turkish, Russian, Greek and Chinese UI languages + TRY/RUB currencies

2026-04-13 09:40:38 +02:00

services

fix: timezone-aware CalDAV sync and English as i18n fallback (#43)

2026-04-13 09:20:27 +02:00

auth.js

fix: change SameSite=Strict to SameSite=Lax for session and CSRF cookies (#46)

2026-04-13 21:36:35 +02:00

db-schema-test.js

fix(imports): convert require() to ESM import for randomBytes in auth.js

2026-04-03 23:00:38 +02:00

db.js

feat(meals): add optional recipe link to meal cards (#18)

2026-04-05 18:03:05 +02:00

index.js

feat(meals): customizable meal type visibility in Settings (#14)

2026-04-04 22:51:57 +02:00

logger.js

fix(imports): convert require() to ESM import for randomBytes in auth.js

2026-04-03 23:00:38 +02:00