mca/parking_solution
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

docs(deploy): COOKIE_SECURE=0 runbook for the plain-HTTP appliance

Browse Source 
Documents the deploy-time requirement that the cookie fail-safe fix (7629d5d)
introduced: the LAN appliance serves the SPA same-origin over plain http, where a
Secure cookie is never sent — so it MUST set COOKIE_SECURE=0 or operators can't log
in. A TLS deploy leaves it unset.

- wiki/concepts/disk-os-hardening.md: new "Deploy-time server configuration (runbook)"
  section listing the security-load-bearing env (JWT_SECRET, EVENT_SIGNING_KEY,
  COOKIE_SECURE=0) with the why + the network-scoped justification.
- wiki/entities/local-jwt-auth.md: corrected the stale "Secure when NODE_ENV=production"
  cookie line to the Secure-by-default / opt-out model.
- wiki/log.md: entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
This commit is contained in:
Julian Çuni
2026-06-21 23:52:21 +02:00
parent 7629d5d7b1
commit 66c1291578
3 changed files with 37 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wiki/log.md
+11
View File
@@ -1329,3 +1329,14 @@ autouse fixture that pins `VISION_RECOGNIZER=stub` (the dev `.env` had set `fast
model-free smoke tests). Also stopped `*.test.ts` leaking into shipped `dist/` (server + shared
tsconfig excludes). Totals: shared 87, server 75, devices 18, web 17, vision 7 = 204 tests; build/lint
14/14. See [[booth-console]].
## [2026-06-21] fix | Auth cookies Secure-by-default; COOKIE_SECURE=0 in the appliance deploy runbook
secureCookies() keyed off NODE_ENV==="production", so an appliance deployed without that var
silently dropped the Secure flag on the auth/CSRF cookies (the code-review's one Medium finding).
Flipped to FAIL-SAFE: Secure by DEFAULT, dropped only on a deliberate COOKIE_SECURE=0/false/no/off
(or NODE_ENV=development as a dev fallback). The plain-http LAN appliance sets COOKIE_SECURE=0 ON
PURPOSE (a Secure cookie is never sent over its http origin → operators couldn't log in); a TLS
deploy leaves it unset. Added a "Deploy-time server configuration (runbook)" section to
[[disk-os-hardening]] documenting COOKIE_SECURE=0 (+ JWT_SECRET / EVENT_SIGNING_KEY) and corrected
the stale "Secure when NODE_ENV=production" line on [[local-jwt-auth]]. auth.test.ts (5) pins the
matrix; server 80/80.