nate/Siteforge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add ALLOW_INSECURE_COOKIES env flag for HTTP access in production

Browse Source 
Browsers drop Secure cookies on plain-http origins, so logging into the
admin over a LAN/VPN IP (e.g. during server migration, before TLS is in
front) silently failed every authenticated request. Setting
ALLOW_INSECURE_COOKIES=true omits the Secure flag; default behavior in
production is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
nmemmert
2026-07-07 12:49:37 -04:00
parent f4fd177421
commit 2e406af471
3 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/helpers.js
+10 -2
View File
@@ -505,10 +505,18 @@ export function hasVisitorConsent(req) {
return cookies['vbn_analytics_consent'] === 'yes'
}
// Secure cookies are required in production unless explicitly disabled with
// ALLOW_INSECURE_COOKIES=true — needed when the app is reached over plain
// HTTP (e.g. by LAN/VPN IP during a server migration, before TLS is set up),
// because browsers silently drop Secure cookies on http:// origins.
export function cookieSecureFlag() {
if (process.env.ALLOW_INSECURE_COOKIES === 'true') return ''
return process.env.NODE_ENV === 'production' ? '; Secure' : ''
}
export function setConsentCookie(res, consent) {
const value = consent ? 'yes' : 'no'
const secureFlag = process.env.NODE_ENV === 'production' ? '; Secure' : ''
res.append('Set-Cookie', `vbn_analytics_consent=${value}; Max-Age=31536000; Path=/; SameSite=Lax${secureFlag}`)
res.append('Set-Cookie', `vbn_analytics_consent=${value}; Max-Age=31536000; Path=/; SameSite=Lax${cookieSecureFlag()}`)
}
export function isPrivateOrLocalIp(ip) {