diff --git a/apps/client/pages/api/auth/[...nextauth].ts b/apps/client/pages/api/auth/[...nextauth].ts index 3b7c9dcb..a641f0ac 100644 --- a/apps/client/pages/api/auth/[...nextauth].ts +++ b/apps/client/pages/api/auth/[...nextauth].ts @@ -85,7 +85,6 @@ export const authOptions = { strategy: 'jwt' as SessionStrategy, maxAge: 1 * 24 * 60 * 60, // 1 Day }, - useSecureCookies: true, providers: [ CredentialsProvider({ name: 'Credentials', diff --git a/apps/server/src/app/middleware/validate-auth-jwt.ts b/apps/server/src/app/middleware/validate-auth-jwt.ts index 2c2cd69c..f3471ebf 100644 --- a/apps/server/src/app/middleware/validate-auth-jwt.ts +++ b/apps/server/src/app/middleware/validate-auth-jwt.ts @@ -1,17 +1,30 @@ import cookieParser from 'cookie-parser' import { decode } from 'next-auth/jwt' +import type { Request } from 'express' const SECRET = process.env.NEXTAUTH_SECRET ?? 'REPLACE_THIS' + +const getNextAuthCookie = (req: Request) => { + if (req.cookies) { + if ('__Secure-next-auth.session-token' in req.cookies) { + return req.cookies['__Secure-next-auth.session-token'] + } else if ('next-auth.session-token' in req.cookies) { + return req.cookies['next-auth.session-token'] + } + } + return undefined +} + export const validateAuthJwt = async (req, res, next) => { cookieParser(SECRET)(req, res, async (err) => { if (err) { return res.status(500).json({ message: 'Internal Server Error' }) } - if (req.cookies && '__Secure-next-auth.session-token' in req.cookies) { + if (req.cookies && getNextAuthCookie(req)) { try { const token = await decode({ - token: req.cookies['__Secure-next-auth.session-token'], + token: getNextAuthCookie(req), secret: SECRET, })