From 775633bfd056bab35fff2e8abfc353ce90d644b8 Mon Sep 17 00:00:00 2001 From: ayrisdev Date: Tue, 1 Sep 2026 12:10:11 +0300 Subject: [PATCH] =?UTF-8?q?fix:=20oturum=20=C3=A7erezini=20x-forwarded-pro?= =?UTF-8?q?to'ya=20g=C3=B6re=20secure=20i=C5=9Faretle?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NODE_ENV=production'da cookie hep secure:true oluyordu, ama panel şu an SSL'siz sslip.io preview domain'inde (http://) çalışıyor — tarayıcı Secure cookie'yi HTTP origin'de hiç saklamıyor. Giriş "başarılı" gibi görünüp anında /login'e geri dönülüyordu. Artık gerçek istek protokolüne (Traefik'in x-forwarded-proto header'ı) bakılıyor. Co-Authored-By: Claude Sonnet 5 --- apps/frontend/app/login/actions.ts | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/apps/frontend/app/login/actions.ts b/apps/frontend/app/login/actions.ts index 07f345d..143f5cf 100644 --- a/apps/frontend/app/login/actions.ts +++ b/apps/frontend/app/login/actions.ts @@ -1,6 +1,6 @@ "use server"; -import { cookies } from "next/headers"; +import { cookies, headers } from "next/headers"; import { redirect } from "next/navigation"; import bcrypt from "bcryptjs"; import { prisma } from "@streamclipper/db"; @@ -11,9 +11,16 @@ const SESSION_MAX_AGE_SEC = 60 * 60 * 24 * 30; async function setSessionCookie(userId: string, username: string) { const token = await createSessionToken({ sub: userId, username }); const jar = await cookies(); + // NODE_ENV alone isn't a reliable signal for this — the panel is often + // served over plain HTTP (e.g. Coolify's auto-generated sslip.io preview + // domain has no TLS). A `Secure` cookie set on an HTTP origin is silently + // dropped by the browser, which made every login look successful for an + // instant and then immediately bounce back to /login. Check the actual + // request scheme instead (Traefik/Coolify sets x-forwarded-proto). + const proto = (await headers()).get("x-forwarded-proto"); jar.set(SESSION_COOKIE_NAME, token, { httpOnly: true, - secure: process.env.NODE_ENV === "production", + secure: proto === "https", sameSite: "lax", path: "/", maxAge: SESSION_MAX_AGE_SEC,