Honor forwarded HTTPS for session cookies (#29)

Author: aiirvizionz

app/api/auth/login/route.ts

@@ -23,6 +23,6 @@ export async function POST(req: NextRequest) {
   }
 
   const res = NextResponse.json({ ok: true, status: account.status, plan: account.plan });
-  res.cookies.set(SESSION_COOKIE, signSession({ sub: `acct:${account.id}`, email: account.email, name: null }), sessionCookieOptions());
+  res.cookies.set(SESSION_COOKIE, signSession({ sub: `acct:${account.id}`, email: account.email, name: null }), sessionCookieOptions(req));
   return res;
 }

app/api/auth/signup/route.ts

@@ -73,7 +73,7 @@ export async function POST(req: NextRequest) {
   // Log the new account in immediately (as a pending account) so the dashboard
   // can show payment status.
   const setCookie = (res: NextResponse) => {
-    res.cookies.set(SESSION_COOKIE, signSession({ sub: `acct:${account.id}`, email, name: null }), sessionCookieOptions());
+    res.cookies.set(SESSION_COOKIE, signSession({ sub: `acct:${account.id}`, email, name: null }), sessionCookieOptions(req));
     return res;
   };
 

app/auth/coinpay/callback/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { coinpayConfigured, signSession, SESSION_COOKIE, SESSION_TTL } from "@/lib/session";
+import { coinpayConfigured, signSession, SESSION_COOKIE, sessionCookieOptions } from "@/lib/session";
 import { exchangeCode, fetchUserinfo, APP_BASE_URL } from "@/lib/oauth";
 import { upsertUser } from "@/lib/db";
 
@@ -29,10 +29,7 @@ export async function GET(req: NextRequest) {
     await upsertUser({ sub: info.sub, email: info.email, name: info.name });
 
     const res = NextResponse.redirect(`${APP_BASE_URL}/`);
-    const secure = APP_BASE_URL.startsWith("https://");
-    res.cookies.set(SESSION_COOKIE, signSession({ sub: info.sub, email: info.email ?? null, name: info.name ?? null }), {
-      httpOnly: true, sameSite: "lax", secure, path: "/", maxAge: SESSION_TTL,
-    });
+    res.cookies.set(SESSION_COOKIE, signSession({ sub: info.sub, email: info.email ?? null, name: info.name ?? null }), sessionCookieOptions(req));
     res.cookies.delete("cp_pkce");
     res.cookies.delete("cp_state");
     return res;

lib/session.ts

@@ -28,12 +28,34 @@ export function signSession(payload: { sub: string; email: string | null; name:
 
 /** Cookie options for the session cookie — secure only when served over https.
  *  Detects TLS proxies (Vercel/Cloudflare/Railway) via x-forwarded-proto and honors NODE_ENV=production. */
-export function sessionCookieOptions() {
-  const proto = (process.env.X_FORWARDED_PROTO || process.env.FORWARDED_PROTO || "").split(",")[0].trim().toLowerCase();
-  const secure =
-    (process.env.NODE_ENV === "production") ||
-    (process.env.APP_BASE_URL || "").startsWith("https://") ||
-    proto === "https";
+type CookieRequest = {
+  headers?: Headers;
+  nextUrl?: URL;
+  url?: string;
+};
+
+function requestIsHttps(req?: CookieRequest): boolean {
+  const proto = (
+    req?.headers?.get("x-forwarded-proto") ||
+    process.env.X_FORWARDED_PROTO ||
+    process.env.FORWARDED_PROTO ||
+    ""
+  ).split(",")[0].trim().toLowerCase();
+  if (proto === "https") return true;
+  if (proto === "http") return false;
+  if (req?.nextUrl?.protocol === "https:") return true;
+  if (req?.url) {
+    try {
+      return new URL(req.url).protocol === "https:";
+    } catch {
+      // Fall back to deployment env below.
+    }
+  }
+  return (process.env.NODE_ENV === "production") || (process.env.APP_BASE_URL || "").startsWith("https://");
+}
+
+export function sessionCookieOptions(req?: CookieRequest) {
+  const secure = requestIsHttps(req);
   return { httpOnly: true, sameSite: "lax" as const, secure, path: "/", maxAge: SESSION_TTL };
 }