From c3f39b8ce2b25682d54277c324cf9f24e7c42352 Mon Sep 17 00:00:00 2001
From: HeavenVR <github@heavenvr.tech>
Date: Tue, 23 Jun 2026 15:14:32 +0200
Subject: [PATCH] fix: derive auth cookie Secure flag from frontend BaseUrl
 scheme

The session cookie hardcoded Secure=true, so over plain HTTP (used by the
frontend Playwright integration stack) the browser silently dropped it.

Derive the Secure flag from the configured OPENSHOCK__FRONTEND__BASEURL
scheme: an http:// base URL emits a non-Secure cookie (dev/integration),
while https:// keeps it Secure-only as in production. SameSite stays Lax.
---
 Common/OpenShockControllerBase.cs | 3 ++-
 Common/Options/FrontendOptions.cs | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/Common/OpenShockControllerBase.cs b/Common/OpenShockControllerBase.cs
index 4e11c2cb..e2f83e92 100644
--- a/Common/OpenShockControllerBase.cs
+++ b/Common/OpenShockControllerBase.cs
@@ -41,6 +41,7 @@ protected OkObjectResult LegacyEmptyOk(string message = "")
     [NonAction]
     protected async Task CreateSession(Guid accountId, string domain)
     {
+        var frontendOptions = HttpContext.RequestServices.GetRequiredService<FrontendOptions>();
         var sessionService = HttpContext.RequestServices.GetRequiredService<ISessionService>();
         
         var session = await sessionService.CreateSessionAsync(accountId, HttpContext.GetUserAgent(), HttpContext.GetRemoteIP().ToString());
@@ -48,7 +49,7 @@ protected async Task CreateSession(Guid accountId, string domain)
         HttpContext.Response.Cookies.Append(AuthConstants.UserSessionCookieName, session.Token, new CookieOptions
         {
             Expires = DateTimeOffset.UtcNow.Add(Duration.LoginSessionLifetime),
-            Secure = true,
+            Secure = frontendOptions.CookieSecure,
             HttpOnly = true,
             SameSite = SameSiteMode.Lax,
             Domain = domain
diff --git a/Common/Options/FrontendOptions.cs b/Common/Options/FrontendOptions.cs
index 6a41bac4..7d9587bb 100644
--- a/Common/Options/FrontendOptions.cs
+++ b/Common/Options/FrontendOptions.cs
@@ -5,4 +5,11 @@ public sealed class FrontendOptions
     public required Uri BaseUrl { get; init; }
     public required Uri ShortUrl { get; init; }
     public required IReadOnlyCollection<string> CookieDomains { get; init; }
+
+    /// <summary>
+    /// Whether auth cookies should be flagged <c>Secure</c>, derived from the configured <see cref="BaseUrl"/> scheme.
+    /// An <c>http://</c> base URL (dev / integration tests over plain HTTP) yields non-secure cookies so the browser
+    /// can store and resend them; an <c>https://</c> base URL keeps cookies <c>Secure</c>-only as in production.
+    /// </summary>
+    public bool CookieSecure => BaseUrl.Scheme == Uri.UriSchemeHttps;
 }
\ No newline at end of file