From f4faef0fa014dff70f09108c4070de3e818568d3 Mon Sep 17 00:00:00 2001 From: Alex Frantz Date: Mon, 7 Sep 2026 01:19:24 -0400 Subject: [PATCH] add trust proxy to fix cookies --- apps/backend/src/controllers/users.ts | 4 +++- apps/backend/src/index.ts | 7 +++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/apps/backend/src/controllers/users.ts b/apps/backend/src/controllers/users.ts index 8c0bf3b..c948928 100644 --- a/apps/backend/src/controllers/users.ts +++ b/apps/backend/src/controllers/users.ts @@ -13,7 +13,9 @@ export async function register( const body = schemas.users.registration.parse(req.body); if (body.email !== "alex@alexav.gg") { - res.status(400).json({ message: "You are not authorized to register" }); + return res + .status(400) + .json({ message: "You are not authorized to register" }); } const email = body.email; diff --git a/apps/backend/src/index.ts b/apps/backend/src/index.ts index 9c581fa..87281c9 100644 --- a/apps/backend/src/index.ts +++ b/apps/backend/src/index.ts @@ -23,6 +23,13 @@ const redisClient = createClient({ url: env.REDIS_URL }); redisClient.connect().catch(console.error); const app = express(); + +// TLS terminates at Traefik and the SSR frontend proxies onward over plain +// HTTP, so req.protocol is "http" here and the session cookie's `secure` flag +// would silently suppress Set-Cookie. Trusting X-Forwarded-Proto restores it. +// The only reachable client is that proxy, on an internal network. +app.set("trust proxy", true); + app.use(express.urlencoded({ extended: false })); app.use(express.json());