set sameSite to lax when allowing insecure cookies (#1078)

huggingface · Apr 26, 2024 · bc30bd1 · bc30bd1
1 parent 745e51e
commit bc30bd1
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
@@ -55,7 +55,7 @@ export function refreshSessionCookie(cookies: Cookies, sessionId: string) {
 	cookies.set(COOKIE_NAME, sessionId, {
 		path: "/",
 		// So that it works inside the space's iframe
-		sameSite: dev ? "lax" : "none",
+		sameSite: dev || ALLOW_INSECURE_COOKIES === "true" ? "lax" : "none",
 		secure: !dev && !(ALLOW_INSECURE_COOKIES === "true"),
 		httpOnly: true,
 		expires: addWeeks(new Date(), 2),

diff --git a/src/routes/logout/+page.server.ts b/src/routes/logout/+page.server.ts
@@ -11,7 +11,7 @@ export const actions = {
 		cookies.delete(COOKIE_NAME, {
 			path: "/",
 			// So that it works inside the space's iframe
-			sameSite: dev ? "lax" : "none",
+			sameSite: dev || ALLOW_INSECURE_COOKIES === "true" ? "lax" : "none",
 			secure: !dev && !(ALLOW_INSECURE_COOKIES === "true"),
 			httpOnly: true,
 		});