search

nfroidure / whook

Build strong and efficient REST web services.
https://slides.com/nfroidure/introducing-whook
MIT License
31 stars 7 forks source link

`DEV_MODE` can cause cookies to be unsafe in production deployments #175

Closed AmnezziaCS closed 6 months ago

AmnezziaCS commented 9 months ago

Expected behavior

Cookies should be safe (secure and same site properties) on a production deployment even when debugging.

Actual behavior

Cookies are missing the secure and same site properties on a production ECS deployment when DEV_MODE is set to true.

This is where cookies are sent: https://github.com/nfroidure/whook/blob/main/packages/whook-oauth2/src/handlers/postAuthLogin.ts#L100-L103

Where cookies are built: https://github.com/nfroidure/whook/blob/main/packages/whook-oauth2/src/services/authCookies.ts