cs_betty/cartsnitch-fork-test
1
0
Fork 0
forked from cartsnitch/cartsnitch
Code Pull Requests Activity

Promote to UAT: fix __Secure- session cookie prefix (#134)

Browse Source 
Promote to UAT: fix __Secure- session cookie prefix (#134)
This commit is contained in:
cartsnitch-cto[bot]
2026-04-04 18:48:44 +00:00
committed by GitHub
parent ccc8189d88 8ddefe82e4
commit 562c6ef6f6
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/src/cartsnitch_api/auth/dependencies.py
+4 -2
View File
@@ -19,6 +19,8 @@ bearer_scheme = HTTPBearer(auto_error=False)
# Better-Auth session cookie name
SESSION_COOKIE_NAME = "better-auth.session_token"
# Secure prefix used by better-auth on HTTPS deployments
SECURE_SESSION_COOKIE_NAME = "__Secure-better-auth.session_token"
async def _validate_session_token(token: str, db: AsyncSession) -> str:
@@ -65,8 +67,8 @@ async def get_current_user(
"""
token: str | None = None
# 1. Check session cookie
cookie_token = request.cookies.get(SESSION_COOKIE_NAME)
# 1. Check session cookie — prefer __Secure- variant (HTTPS) over plain (HTTP dev)
cookie_token = request.cookies.get(SECURE_SESSION_COOKIE_NAME) or request.cookies.get(SESSION_COOKIE_NAME)
if cookie_token:
token = cookie_token