gronod f41d14b2a9 fix: gate cookie secure flag on TRUST_PROXY not NODE_ENV ...

secure:true cookies are only sent by browsers over HTTPS connections.
When NODE_ENV=production (always set in the Docker container) but no
TLS proxy is in front, the browser receives the cookie on login but
refuses to send it on subsequent HTTP requests — causing every
authenticated endpoint (/stream, /status, etc.) to return 401.

The correct signal is TRUST_PROXY: it is only set when a TLS-terminating
reverse proxy is confirmed to be in front. Affects emby_user and
csrf_token cookies across login, /csrf refresh, and logout.

2026-05-17 09:42:56 +01:00

6.8 KiB

Raw Blame History

View Raw