propro-utils 1.6.6 → 1.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.6.6",
+  "version": "1.6.7",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/middleware/cookieUtils.js

@@ -100,6 +100,7 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
 
   // Domain configuration
   let domain;
+  let isSecureConnection = false;
   try {
     // Handle URLs that don't include the protocol
     let processedAppUrl = appUrl;
@@ -111,12 +112,16 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
       processedAppUrl = `https://${appUrl}`;
     }
 
-    domain = processedAppUrl ? new URL(processedAppUrl).hostname : undefined;
+    const urlObj = new URL(processedAppUrl);
+    domain = urlObj.hostname;
+    isSecureConnection = urlObj.protocol === "https:";
+
     if (domain?.includes("mapmap.app")) {
       domain = ".mapmap.app";
     }
     if (domain?.includes("localhost")) {
       domain = undefined;
+      isSecureConnection = false;
     }
     if (domain?.includes("propro.so")) {
       // Handle both main domain and subdomains of propro.so
@@ -126,9 +131,18 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
         domain = "propro.so";
       }
     }
+
+    console.log("Cookie configuration:", {
+      domain,
+      isSecure: isSecureConnection,
+      protocol: urlObj.protocol,
+      originalUrl: appUrl,
+      processedUrl: processedAppUrl,
+    });
   } catch (error) {
     console.error("Invalid appUrl:", { error, appUrl });
     domain = undefined;
+    isSecureConnection = false;
   }
 
   // Determine if we're in a local development environment
@@ -136,12 +150,14 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     !domain || domain === "localhost" || domain.includes("localhost");
 
   const commonAttributes = {
-    secure: !isLocalhost, // Only require secure for non-localhost environments
-    sameSite: isLocalhost ? "Lax" : "None", // Use Lax for localhost, None for production
+    secure: isSecureConnection,
+    sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
   };
 
+  console.log("Cookie attributes:", commonAttributes);
+
   const httpOnlyCookies = {
     "x-refresh-token": {
       value: tokens.refresh.token,
@@ -225,6 +241,7 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
  */
 const clearAuthCookies = async (res, appUrl) => {
   let domain;
+  let isSecureConnection = false;
   try {
     // Handle URLs that don't include the protocol
     let processedAppUrl = appUrl;
@@ -236,12 +253,16 @@ const clearAuthCookies = async (res, appUrl) => {
       processedAppUrl = `https://${appUrl}`;
     }
 
-    domain = processedAppUrl ? new URL(processedAppUrl).hostname : undefined;
+    const urlObj = new URL(processedAppUrl);
+    domain = urlObj.hostname;
+    isSecureConnection = urlObj.protocol === "https:";
+
     if (domain?.includes("mapmap.app")) {
       domain = ".mapmap.app";
     }
     if (domain?.includes("localhost")) {
       domain = undefined;
+      isSecureConnection = false;
     }
     if (domain?.includes("propro.so")) {
       // Handle both main domain and subdomains of propro.so
@@ -251,22 +272,29 @@ const clearAuthCookies = async (res, appUrl) => {
         domain = "propro.so";
       }
     }
+
+    console.log("Clear cookies configuration:", {
+      domain,
+      isSecure: isSecureConnection,
+      protocol: urlObj.protocol,
+      originalUrl: appUrl,
+      processedUrl: processedAppUrl,
+    });
   } catch (error) {
     console.error("Invalid appUrl:", error);
     domain = undefined;
+    isSecureConnection = false;
   }
 
-  // Determine if we're in a local development environment
-  const isLocalhost =
-    !domain || domain === "localhost" || domain.includes("localhost");
-
   const commonAttributes = {
-    secure: !isLocalhost, // Only require secure for non-localhost environments
-    sameSite: isLocalhost ? "Lax" : "None", // Use Lax for localhost, None for production
+    secure: isSecureConnection,
+    sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
   };
 
+  console.log("Clear cookie attributes:", commonAttributes);
+
   const cookieNames = [
     "x-refresh-token",
     "x-access-token",