fix: set Secure flag on session cookie in production mode (closes #5)

2026-02-08 12:05:09 -08:00
parent d4eae284b5
commit 185daab909
2 changed files with 71 additions and 0 deletions
--- a/internal/service/auth/auth.go
+++ b/internal/service/auth/auth.go
@@ -73,6 +73,7 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 		Path:     "/",
 		MaxAge:   sessionMaxAgeSeconds,
 		HttpOnly: true,
+		Secure:   !params.Config.Debug,
 		SameSite: http.SameSiteLaxMode,
 	}