From 52bcd7cca8da48a62ba52d51ee5a1cf5f0a5f6a5 Mon Sep 17 00:00:00 2001 From: Fuwn Date: Mon, 1 Jun 2026 13:01:06 +0000 Subject: fix(security): mark auth cookies Secure outside localhost The user and logout cookies were set with secure:false, so the AniList tokens the user cookie carries could traverse plaintext HTTP. Drop the override and let SvelteKit's default apply (Secure everywhere except http://localhost), giving Secure in production and on https://due.localhost while keeping plain-http local dev working. httpOnly is unchanged (the client reads the token from layout data; tightening that is tracked separately as the architectural part of C2). --- src/lib/Utility/oauth.ts | 1 - 1 file changed, 1 deletion(-) (limited to 'src/lib') diff --git a/src/lib/Utility/oauth.ts b/src/lib/Utility/oauth.ts index c225d43c..84dd8ab8 100644 --- a/src/lib/Utility/oauth.ts +++ b/src/lib/Utility/oauth.ts @@ -43,7 +43,6 @@ export const callback = async (options: CallbackOptions) => { maxAge: 31536000 / 2, httpOnly: false, sameSite: "lax", - secure: false, }, ); -- cgit v1.2.3