PanSalut/Koffan v1.0.11

on GitHub

Bug Fixes

• Fixed login redirect loop on HTTP connections - Session cookie was incorrectly set with Secure flag when APP_ENV=production, which broke authentication when accessing the app via HTTP (e.g., on local network by IP address). Now the Secure flag is set based on actual connection protocol.

Technical Details

• Added isSecureConnection() helper that checks:
  • X-Forwarded-Proto header (for reverse proxy setups)
  • Direct connection protocol
• This ensures cookies work correctly on both HTTP (local network) and HTTPS (behind reverse proxy) setups.

Fixes #1