Keep HTTP admin and cabinet sessions by not requiring Secure cookies or Origin CSRF.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 01:13:19 +03:00
parent 4dbfe782f5
commit a6a748281f
9 changed files with 20 additions and 9 deletions
@@ -8,8 +8,7 @@ export const Users: CollectionConfig = {
    tokenExpiration: 60 * 60 * 24 * 7,
    cookies: {
      sameSite: 'Lax',
-      // HTTP admin (IP:3001) cannot store Secure cookies; enable only on HTTPS.
-      secure: (process.env.NEXT_PUBLIC_SERVER_URL || '').startsWith('https://'),
+      secure: false,
    },
  },
  admin: {