Ulas 3f387b616e fix: default TRUST_PROXY to 1 for Docker+reverse-proxy setups (#46) ...

With the previous default of 'loopback', Express ignored X-Forwarded-Proto
headers from Caddy/nginx when running in Docker (bridge IP, not loopback).
This caused req.secure=false, which made express-session silently drop the
session cookie on login - resulting in a 401 on every subsequent request.

Changing the default to 1 (trust one proxy hop) fixes this for all standard
Docker+reverse-proxy deployments without requiring manual configuration.

2026-04-14 09:04:06 +02:00

..

middleware

fix: change SameSite=Strict to SameSite=Lax for session and CSRF cookies (#46)

2026-04-13 21:36:35 +02:00

routes

fix: restore weather widget position - display directly below greeting banner

2026-04-14 08:52:00 +02:00

services

fix: timezone-aware CalDAV sync and English as i18n fallback (#43)

2026-04-13 09:20:27 +02:00

auth.js

fix: change SameSite=Strict to SameSite=Lax for session and CSRF cookies (#46)

2026-04-13 21:36:35 +02:00

db-schema-test.js

fix(imports): convert require() to ESM import for randomBytes in auth.js

2026-04-03 23:00:38 +02:00

db.js

feat(meals): add optional recipe link to meal cards (#18)

2026-04-05 18:03:05 +02:00

index.js

fix: default TRUST_PROXY to 1 for Docker+reverse-proxy setups (#46)

2026-04-14 09:04:06 +02:00

logger.js

fix(imports): convert require() to ESM import for randomBytes in auth.js

2026-04-03 23:00:38 +02:00