@camstack/server 1.2.246 → 1.2.248

package/dist/auth/session-cookie.js

@@ -8,6 +8,7 @@ exports.shouldRedirectToLogin = shouldRedirectToLogin;
 exports.loginRedirectUrl = loginRedirectUrl;
 exports.isEmbedRedirectTarget = isEmbedRedirectTarget;
 exports.isSessionGradeJwtPayload = isSessionGradeJwtPayload;
+exports.sessionCookieIsSecure = sessionCookieIsSecure;
 /** Browser session cookie carrying the hub JWT. Set by POST /api/auth/session
  *  after a tRPC login; read by the addon-route catch-all for `authenticated`
  *  routes hit by a plain browser navigation. */
@@ -105,3 +106,43 @@ function isSessionGradeJwtPayload(payload) {
     const p = payload;
     return p.kind === undefined && typeof p.userId === 'string' && typeof p.isAdmin === 'boolean';
 }
+/**
+ * Should the session cookie carry `Secure`, for a request that may have crossed
+ * a reverse proxy?
+ *
+ * The hub decides this from its own leg of the connection, and behind a proxy
+ * that leg is the wrong one. Home Assistant's relay reaches the hub over HTTPS
+ * while the browser reached Home Assistant over plain HTTP on the LAN, so the
+ * hub marked the cookie `Secure` and the browser silently DISCARDED it: the
+ * login succeeded, the session existed, and every `<img>` that can only
+ * authenticate by cookie came back 401 while the rest of the app — which
+ * attaches its bearer token explicitly — worked. That is why the admin UI
+ * showed no snapshots inside Home Assistant and everything else looked fine.
+ *
+ * The relay already SENDS `X-Forwarded-Proto` with the browser's own scheme,
+ * next to the prefix header the admin UI's `<base>` depends on. Only this side
+ * was missing: the hub read its own socket and never the declaration.
+ *
+ * Two guards, because `X-Forwarded-Proto` is a client-supplied string:
+ *
+ *  - it may only ever DOWNGRADE. A request that arrived here over plain HTTP
+ *    can never be talked into claiming HTTPS, so the header cannot be used to
+ *    make a cookie look safer than its transport.
+ *  - it is read ONLY when the request also carries the relay's prefix header,
+ *    which is set by the proxy and by nothing else on a direct browser hit. A
+ *    direct caller inventing the proto header alone changes nothing.
+ */
+function sessionCookieIsSecure(requestProtocol, headers, forwardedPrefixHeader) {
+    const secureLeg = requestProtocol === 'https';
+    if (!secureLeg)
+        return false;
+    if (headers[forwardedPrefixHeader] === undefined)
+        return true;
+    const raw = headers['x-forwarded-proto'];
+    const proto = Array.isArray(raw) ? raw[0] : raw;
+    if (proto === undefined)
+        return true;
+    // A comma list means several hops; the FIRST is the browser's own scheme.
+    const browserScheme = proto.split(',')[0]?.trim().toLowerCase();
+    return browserScheme !== 'http';
+}

package/dist/main.js

@@ -894,13 +894,17 @@ async function bootstrap() {
             catch {
                 return reply.status(401).send({ error: 'invalid token' });
             }
-            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, { secure: request.protocol === 'https' });
+            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
+                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
+            });
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
         });
         // DELETE /api/auth/session — clear the cookie on logout.
         fastify.delete('/api/auth/session', async (request, reply) => {
-            const c = (0, session_cookie_js_1.clearSessionCookie)({ secure: request.protocol === 'https' });
+            const c = (0, session_cookie_js_1.clearSessionCookie)({
+                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
+            });
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
         });
@@ -930,7 +934,9 @@ async function bootstrap() {
             catch {
                 return reply.status(401).send({ error: 'invalid token' });
             }
-            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, { secure: request.protocol === 'https' });
+            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
+                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
+            });
             reply.setCookie(c.name, c.value, c.options);
             return reply.redirect(next);
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.246",
+  "version": "1.2.248",
   "private": false,
   "files": [
     "dist",