propro-utils 1.6.7 → 1.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/middleware/cookieUtils.js

@@ -126,9 +126,9 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     if (domain?.includes("propro.so")) {
       // Handle both main domain and subdomains of propro.so
       if (domain.startsWith("short.")) {
-        domain = "short.propro.so";
+        domain = ".short.propro.so";
       } else {
-        domain = "propro.so";
+        domain = ".propro.so";
       }
     }
 
@@ -154,6 +154,8 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
+    httpOnly: false,
+    expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
   };
 
   console.log("Cookie attributes:", commonAttributes);
@@ -163,11 +165,13 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
       value: tokens.refresh.token,
       maxAge: refreshMaxAge,
       httpOnly: true,
+      secure: isSecureConnection,
     },
     "x-access-token": {
       value: tokens.access.token,
       maxAge: accessMaxAge,
       httpOnly: true,
+      secure: isSecureConnection,
     },
   };
 
@@ -179,14 +183,20 @@ const setAuthCookies = async (res, tokens, account, user, appUrl) => {
     user: {
       value: safeStringify(sanitizedUser),
       maxAge: refreshMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
     account: {
       value: safeStringify(sanitizedAccount),
       maxAge: refreshMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
     has_account_token: {
       value: JSON.stringify({ value: "true", expires: accessMaxAge }),
       maxAge: accessMaxAge,
+      httpOnly: false,
+      secure: isSecureConnection,
     },
   };
 
@@ -291,6 +301,8 @@ const clearAuthCookies = async (res, appUrl) => {
     sameSite: isSecureConnection ? "None" : "Lax",
     domain,
     path: "/",
+    httpOnly: false,
+    expires: new Date(0),
   };
 
   console.log("Clear cookie attributes:", commonAttributes);