Context
setRefreshTokenCookie in internal/api/http/routes/auth.go:31-41 hardcodes Secure: false (line 37) with a comment "Set to true in production with HTTPS". Production runs behind nginx HTTPS (https://mini-maxit.pl). The flag must be environment-configurable so prod sets Secure: true.
Note: Secure:false also breaks cookie binding on HTTPS in some browser configs and is a security concern (refresh token sent over plain HTTP if site reachable over http).
Required changes
- Add config option (e.g.
COOKIE_SECURE env, default true or derived from X-Forwarded-Proto), wired through config.Config into AuthRouteImpl.
- Apply in
setRefreshTokenCookie and the logout cookie clear (auth.go:199-206).
- Set the env in deployment compose (prod) appropriately.
- Consider SameSite handling for cross-site dev (currently
SameSiteStrictMode — fine for same-site dev localhost:5173→localhost:8000, OK in prod same-origin).
Acceptance criteria
Secure flag controlled by env; prod compose sets it.- Refresh/logout still work on
https://mini-maxit.pl and local dev.
Context
setRefreshTokenCookieininternal/api/http/routes/auth.go:31-41hardcodesSecure: false(line 37) with a comment "Set to true in production with HTTPS". Production runs behind nginx HTTPS (https://mini-maxit.pl). The flag must be environment-configurable so prod setsSecure: true.Note:
Secure:falsealso breaks cookie binding on HTTPS in some browser configs and is a security concern (refresh token sent over plain HTTP if site reachable over http).Required changes
COOKIE_SECUREenv, defaulttrueor derived fromX-Forwarded-Proto), wired throughconfig.ConfigintoAuthRouteImpl.setRefreshTokenCookieand the logout cookie clear (auth.go:199-206).SameSiteStrictMode— fine for same-site devlocalhost:5173→localhost:8000, OK in prod same-origin).Acceptance criteria
Secureflag controlled by env; prod compose sets it.https://mini-maxit.pland local dev.