remco/EpicNext-Cms
1
1 Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(proxy): keep admin login and assets working on plain-HTTP hosts #63

Merged
Simo merged 1 commits from fix/http-auth-csp into main 2026-10-28 22:05:21 +01:00
Conversation 0 Commits 1 Files Changed 5
+94 -6
Simo commented 2026-10-28 22:05:08 +01:00
Collaborator
Copy link
Copy source

The /admin guard always read the __Secure- session cookie, but Auth.js
only uses that name when AUTH_URL (or the request) is HTTPS. With an
http:// AUTH_URL a signed-in admin was bounced between /admin and /login
until the browser threw "too many history calls". The guard now picks the
cookie name the same way Auth.js does.

The CSP also sent upgrade-insecure-requests to plain-HTTP visitors, so
the browser rewrote same-origin fonts/scripts to https:// where nothing
listens. It is now only sent when the visitor reached us over HTTPS.

Co-Authored-By: Claude Opus 5.5 [email protected]

The /admin guard always read the `__Secure-` session cookie, but Auth.js only uses that name when AUTH_URL (or the request) is HTTPS. With an http:// AUTH_URL a signed-in admin was bounced between /admin and /login until the browser threw "too many history calls". The guard now picks the cookie name the same way Auth.js does. The CSP also sent `upgrade-insecure-requests` to plain-HTTP visitors, so the browser rewrote same-origin fonts/scripts to https:// where nothing listens. It is now only sent when the visitor reached us over HTTPS. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Simo added 1 commit 2026-10-28 22:05:08 +01:00
fix(proxy): keep admin login and assets working on plain-HTTP hosts
CI / check (push) Skipped
CI / tests-unit (push) Skipped
CI / tests-integration (push) Skipped
CI / tests-ui (push) Skipped
CI / preflight (push) Skipped
CI / check (pull_request) Successful in 38s
Details
CI / tests-imaging-browsers (pull_request) Skipped
Details
CI / tests-quality (pull_request) Skipped
Details
CI / tests-unit (pull_request) Failing after 36s
Details
CI / tests-integration (pull_request) Successful in 2m36s
Details
CI / tests-ui (pull_request) Successful in 6m21s
Details
CI / preflight (pull_request) Skipped
Details
CI / deploy (pull_request) Skipped
Details
fa34efd3f0 
The /admin guard always read the `__Secure-` session cookie, but Auth.js
only uses that name when AUTH_URL (or the request) is HTTPS. With an
http:// AUTH_URL a signed-in admin was bounced between /admin and /login
until the browser threw "too many history calls". The guard now picks the
cookie name the same way Auth.js does.

The CSP also sent `upgrade-insecure-requests` to plain-HTTP visitors, so
the browser rewrote same-origin fonts/scripts to https:// where nothing
listens. It is now only sent when the visitor reached us over HTTPS.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Simo merged commit efa6cca1d7 into main 2026-10-28 22:05:21 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Simo renovate-bot (Renovate Bot) remco (Remco)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: remco/EpicNext-Cms#63