Nicolas
266f540d88
Found on http://batch.dev.kyuno.fr/: login/signup succeeded (200/201, profile in the body) but every subsequent request 401'd. Cause: the session cookie is `secure: NODE_ENV === "production"`, and docker-compose.yml sets NODE_ENV=production regardless of whether the deployment actually has TLS in front of it. A Secure cookie is silently never sent back by the browser over plain HTTP — no error, just a cookie that never round-trips. Adds COOKIE_SECURE, independent from NODE_ENV, to override the flag per deployment. Unset (default) keeps prior behavior — secure in production. Set COOKIE_SECURE=false only for a deployment reachable over plain HTTP (no TLS yet), like this dev instance. Verified locally: docker compose up with COOKIE_SECURE=false persists and round-trips the cookie (signup -> /auth/me 200); without it, the cookie still gets Secure as before. Full pnpm --filter api test / test:bdd suites still pass (66 + 25 scenarios). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
1.1 KiB
Text
23 lines
1.1 KiB
Text
# Used by docker-compose.yml to provision the local Postgres container.
|
|
# Pick your own values — do not reuse these across environments, and never
|
|
# commit the real .env (it's git-ignored).
|
|
POSTGRES_USER=changeme
|
|
POSTGRES_PASSWORD=changeme
|
|
POSTGRES_DB=batchcooking
|
|
POSTGRES_PORT=5432
|
|
|
|
# Used by docker-compose.yml's "app" service (Docker-only — the native
|
|
# `pnpm dev:api` workflow reads apps/api/.env instead, set both when using
|
|
# both workflows). Required, no default on purpose — generate your own.
|
|
JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Optional — host port for the Docker review stack's single app container
|
|
# (docker-compose.yml), serving both the API and the built frontend.
|
|
# APP_PORT=3000
|
|
|
|
# Optional — only set this to false if THIS deployment is served over
|
|
# plain HTTP (no TLS in front of it). Left unset, the session cookie
|
|
# requires HTTPS (Secure attribute) as it should for a real deployment;
|
|
# over plain HTTP a Secure cookie is silently never sent back by the
|
|
# browser, so login "succeeds" but every subsequent request 401s.
|
|
# COOKIE_SECURE=false
|