greend-server 1.0.4 → 1.0.5

package/.env.example

@@ -20,11 +20,25 @@ HOST=0.0.0.0
 # Never use the default in production.
 SESSION_SECRET=change-this-to-a-long-random-string
 
+# ──────────────────────────────────────────────────────────────────────────────
+# Session cookie security
+# ──────────────────────────────────────────────────────────────────────────────
+# Controls whether session cookies require a secure (HTTPS) transport.
+#   false — required for local HTTP setups (Electron desktop, dev, LAN installs)
+#   true  — required when greend-server is behind HTTPS
+#   auto  — derives from NODE_ENV (production → true, anything else → false)
+#
+# Common mistake: leaving this unset while NODE_ENV=production on a plain HTTP
+# server causes a login loop — login succeeds server-side but the Secure cookie
+# is never accepted by the client.
+SESSION_COOKIE_SECURE=false
+
 # Origins allowed to make cross-origin requests (comma-separated).
 # The GreenD desktop app connects from app://localhost.
 # If you also access GreenD from a browser, add that origin too.
 # Example: CORS_ORIGIN=app://localhost,https://greend.yourcompany.com
 CORS_ORIGIN=app://localhost
 
-# Set to 'production' to enable secure cookie flags.
+# Node environment. Does NOT control cookie security when SESSION_COOKIE_SECURE
+# is set explicitly. Still affects other Express/library defaults.
 NODE_ENV=production

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "greend-server",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "GreenD ESG backend — self-hosted Express.js API server",
   "type": "module",
   "main": "server.js",
@@ -33,7 +33,6 @@
   "files": [
     "server.js",
     "bin/",
-    "data/.gitkeep",
     ".env.example"
   ],
   "publishConfig": { "access": "public" }

package/server.js

@@ -47,9 +47,18 @@ const DATA_DIR = process.env.DATA_DIR
   : getDefaultDataDir();
 
 const SESSION_COOKIE_NAME = 'connect.sid';
+
+function resolveCookieSecure() {
+  const raw = (process.env.SESSION_COOKIE_SECURE ?? 'auto').toLowerCase().trim();
+  if (raw === 'true')  return true;
+  if (raw === 'false') return false;
+  // 'auto' or unrecognised: derive from NODE_ENV for backward compatibility
+  return process.env.NODE_ENV === 'production';
+}
+
 const SESSION_COOKIE_OPTIONS = {
   httpOnly: true,
-  secure: process.env.NODE_ENV === 'production',
+  secure: resolveCookieSecure(),
   sameSite: 'lax',
   path: '/',
   maxAge: 8 * 60 * 60 * 1000,
@@ -62,6 +71,10 @@ const CLEAR_SESSION_COOKIE_OPTIONS = {
   path: SESSION_COOKIE_OPTIONS.path,
 };
 
+if (!SESSION_COOKIE_OPTIONS.secure && process.env.NODE_ENV === 'production') {
+  console.warn('[greend-server] WARNING: Session cookies are insecure (SESSION_COOKIE_SECURE=false) while NODE_ENV=production. Acceptable only for local HTTP deployments.');
+}
+
 // ---------------------------------------------------------------------------
 // File-backed session store — persists sessions to DATA_DIR/sessions.json so
 // that sessions survive server restarts (MemoryStore loses them on every restart).