Bohan Jiang 824d943848 fix(auth): derive cookie Secure flag from FRONTEND_ORIGIN scheme (#1390) ...

The session cookie's Secure flag was tied to APP_ENV, and the
docker-compose self-host stack defaults APP_ENV to "production". On
plain-HTTP self-host deployments (LAN IP, private network) the browser
silently drops Secure cookies, leaving every subsequent /api/* call
anonymous and surfacing as 401 "auth: no token found" right after a
successful login.

Derive Secure from the scheme of FRONTEND_ORIGIN so HTTPS origins get
Secure cookies and plain-HTTP origins get non-secure cookies the
browser will actually store. Also harden cookieDomain() against the
other common trap: COOKIE_DOMAIN=<ip>, which RFC 6265 forbids and
browsers reject. Log a one-shot warning and fall back to host-only.

Docs: correct the COOKIE_DOMAIN description (it was labelled as
CloudFront-only but applies to session cookies too) and call out the
IP-literal pitfall in SELF_HOSTING_ADVANCED.md, self-hosting.mdx, and
.env.example.

Refs #1321

2026-04-20 19:53:15 +08:00

..

cloudfront.go

…

cookie_test.go

fix(auth): derive cookie Secure flag from FRONTEND_ORIGIN scheme (#1390)

2026-04-20 19:53:15 +08:00

cookie.go

fix(auth): derive cookie Secure flag from FRONTEND_ORIGIN scheme (#1390)

2026-04-20 19:53:15 +08:00

jwt.go

feat(daemon): add authentication for daemon API routes

2026-03-31 16:19:02 +08:00