From 1d0d87af6e1932c2dddfa7819a6c5c12eaf03d9c Mon Sep 17 00:00:00 2001
From: NGPixel <github@ngpixel.com>
Date: Thu, 8 Jan 2026 04:22:22 -0500
Subject: [PATCH] fix: add cookie secure flag when site is using https

---
 server/controllers/auth.js | 8 ++++----
 server/core/auth.js        | 3 ++-
 server/helpers/common.js   | 9 +++++++++
 server/models/users.js     | 2 +-
 4 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/server/controllers/auth.js b/server/controllers/auth.js
index 524d3f03..7a947338 100644
--- a/server/controllers/auth.js
+++ b/server/controllers/auth.js
@@ -4,8 +4,8 @@ const express = require('express')
 const ExpressBrute = require('express-brute')
 const BruteKnex = require('../helpers/brute-knex')
 const router = express.Router()
-const moment = require('moment')
 const _ = require('lodash')
+const commonHelper = require('../helpers/common')
 
 const bruteforce = new ExpressBrute(new BruteKnex({
   createTable: true,
@@ -70,7 +70,7 @@ router.all('/login/:strategy/callback', async (req, res, next) => {
     const authResult = await WIKI.models.users.login({
       strategy: req.params.strategy
     }, { req, res })
-    res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })
+    res.cookie('jwt', authResult.jwt, commonHelper.getCookieOpts())
 
     const loginRedirect = req.cookies['loginRedirect']
     if (loginRedirect === '/' && authResult.redirect) {
@@ -102,7 +102,7 @@ router.post('/login', bruteforce.prevent, async (req, res, next) => {
         password: req.body.pass
       }, { req, res })
       req.brute.reset()
-      res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })
+      res.cookie('jwt', authResult.jwt, commonHelper.getCookieOpts())
       res.redirect('/')
     } catch (err) {
       const { formStrategies, socialStrategies } = await WIKI.models.authentication.getStrategiesForLegacyClient()
@@ -152,7 +152,7 @@ router.get('/verify/:token', bruteforce.prevent, async (req, res, next) => {
       res.redirect('/login')
     } else {
       const result = await WIKI.models.users.refreshToken(usr)
-      res.cookie('jwt', result.token, { expires: moment().add(1, 'years').toDate() })
+      res.cookie('jwt', result.token, commonHelper.getCookieOpts())
       res.redirect('/')
     }
   } catch (err) {
diff --git a/server/core/auth.js b/server/core/auth.js
index 6eb06b08..fb30c970 100644
--- a/server/core/auth.js
+++ b/server/core/auth.js
@@ -8,6 +8,7 @@ const crypto = require('crypto')
 const pem2jwk = require('pem-jwk').pem2jwk
 const randomBytesAsync = require('util').promisify(crypto.randomBytes)
 
+const commonHelper = require('../helpers/common')
 const securityHelper = require('../helpers/security')
 
 /* global WIKI */
@@ -154,7 +155,7 @@ module.exports = {
           if (req.get('content-type') === 'application/json') {
             res.set('new-jwt', newToken.token)
           } else {
-            res.cookie('jwt', newToken.token, { expires: DateTime.utc().plus({ days: 365 }).toJSDate() })
+            res.cookie('jwt', newToken.token, commonHelper.getCookieOpts())
           }
 
           // Avoid caching this response
diff --git a/server/helpers/common.js b/server/helpers/common.js
index e2a38a35..21cd577d 100644
--- a/server/helpers/common.js
+++ b/server/helpers/common.js
@@ -1,4 +1,7 @@
+/* global WIKI */
+
 const _ = require('lodash')
+const { DateTime } = require('luxon')
 
 module.exports = {
   /**
@@ -38,5 +41,11 @@ module.exports = {
       })
       return result
     }, {})
+  },
+  getCookieOpts () {
+    return {
+      expires: DateTime.utc().plus({ days: 365 }).toJSDate(),
+      ...(WIKI.config.host.startsWith('https://') ? { secure: true } : {})
+    }
   }
 }
diff --git a/server/models/users.js b/server/models/users.js
index 8191621d..8996206d 100644
--- a/server/models/users.js
+++ b/server/models/users.js
@@ -502,7 +502,7 @@ module.exports = class User extends Model {
       if (!usr.isActive) {
         throw new WIKI.Error.AuthAccountBanned()
       }
-      
+
       await WIKI.models.users.query().patch({
         password: newPassword,
         mustChangePwd: false