From 61b9c238030c709da1d9f33f96b6c87969279b25 Mon Sep 17 00:00:00 2001
From: Georges Haddad <g.haddad@anatsecurity.fr>
Date: Fri, 10 Apr 2026 16:15:37 +0300
Subject: [PATCH] Fix: secure cookie only over HTTPS, not plain HTTP

---
 routers/auth.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/routers/auth.py b/routers/auth.py
index 0dd79c8..39b45c0 100644
--- a/routers/auth.py
+++ b/routers/auth.py
@@ -42,12 +42,14 @@ async def login_post(request: Request, username: str = Form(...), password: str
     sessions[session_id] = dict(user)
     
     from config import ENVIRONMENT
+    # secure=True only when accessed via HTTPS (check X-Forwarded-Proto from nginx)
+    is_https = ENVIRONMENT == "production" and request.headers.get("x-forwarded-proto") == "https"
     response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
     response.set_cookie(
         key="session_id",
         value=session_id,
         httponly=True,
-        secure=ENVIRONMENT == "production",
+        secure=is_https,
         samesite="lax",
         max_age=86400,  # 24 hours
     )