add support for http.

Overlord-Server/src/server/routes/auth-cookie.ts

@@ -0,0 +1,47 @@
+function envFlagEnabled(value: string): boolean {
+  const v = value.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
+function envFlagDisabled(value: string): boolean {
+  const v = value.trim().toLowerCase();
+  return v === "0" || v === "false" || v === "no" || v === "off";
+}
+
+export function shouldUseSecureAuthCookie(req: Request): boolean {
+  const mode = String(process.env.OVERLORD_AUTH_COOKIE_SECURE || "auto");
+  if (envFlagEnabled(mode)) {
+    return true;
+  }
+  if (envFlagDisabled(mode)) {
+    return false;
+  }
+
+  const forwardedProto = req.headers
+    .get("x-forwarded-proto")
+    ?.split(",")[0]
+    ?.trim()
+    ?.toLowerCase();
+  if (forwardedProto === "https") {
+    return true;
+  }
+  if (forwardedProto === "http") {
+    return false;
+  }
+
+  try {
+    return new URL(req.url).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+export function makeAuthCookie(token: string, maxAgeSeconds: number, req: Request): string {
+  const securePart = shouldUseSecureAuthCookie(req) ? "Secure; " : "";
+  return `overlord_token=${token}; HttpOnly; ${securePart}SameSite=Strict; Path=/; Max-Age=${maxAgeSeconds}`;
+}
+
+export function makeAuthCookieClear(req: Request): string {
+  const securePart = shouldUseSecureAuthCookie(req) ? "Secure; " : "";
+  return `overlord_token=; HttpOnly; ${securePart}SameSite=Strict; Path=/; Max-Age=0`;
+}

Overlord-Server/src/server/routes/auth-routes.ts

@@ -15,6 +15,7 @@ import {
   recordSuccessfulAttempt,
 } from "../../rateLimit";
 import { getUserById } from "../../users";
+import { makeAuthCookie, makeAuthCookieClear } from "./auth-cookie";
 
 type RequestIpProvider = {
   requestIP: (req: Request) => { address?: string } | null | undefined;
@@ -95,7 +96,7 @@ export async function handleAuthRoutes(
           {
             headers: {
               "Content-Type": "application/json",
-              "Set-Cookie": `overlord_token=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${sessionTtlSeconds}`,
+              "Set-Cookie": makeAuthCookie(token, sessionTtlSeconds, req),
             },
           },
         );
@@ -148,7 +149,7 @@ export async function handleAuthRoutes(
     return new Response(JSON.stringify({ ok: true }), {
       headers: {
         "Content-Type": "application/json",
-        "Set-Cookie": `overlord_token=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`,
+        "Set-Cookie": makeAuthCookieClear(req),
       },
     });
   }

Overlord-Server/src/server/routes/users-routes.ts

@@ -18,6 +18,7 @@ import {
   updateUserPassword,
   updateUserRole,
 } from "../../users";
+import { makeAuthCookie } from "./auth-cookie";
 
 type RequestIpProvider = {
   requestIP: (req: Request) => { address?: string } | null | undefined;
@@ -131,7 +132,7 @@ export async function handleUsersRoutes(
             {
               headers: {
                 "Content-Type": "application/json",
-                "Set-Cookie": `overlord_token=${newToken}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${sessionTtlSeconds}`,
+                "Set-Cookie": makeAuthCookie(newToken, sessionTtlSeconds, req),
               },
             },
           );