Fix: cookie timeout

2025-12-12 02:09:46 +08:00
parent 87ae3b76c2
commit 1cf3a9ef0b
6 changed files with 57 additions and 8 deletions
--- a/handlers/auth/postLogin.go
+++ b/handlers/auth/postLogin.go
@@ -63,10 +63,14 @@ func (self *Handlers) PostLogin(
 	}

 	http.SetCookie(w, &http.Cookie{
-		Name:  "refresh_token",
-		Value: session.RefreshToken,
+		Name:     "refresh_token",
+		Value:    session.RefreshToken,
+		Path:     "/",
+		Secure:   viper.GetBool("https"),
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
 		Expires: time.Now().Add(time.Duration(
-			viper.GetInt64("REFRESH_TOKEN_TIMEOUT")) * time.Second),
+			viper.GetInt64("refresh-token-timeout")) * time.Second),
 	})

 	return utils.Success(w)