From 698fbd76583c75c9953377c90b6586f4117a833f Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Wed, 8 Jul 2026 14:55:28 +0200
Subject: [PATCH] Fix session cookie secure flag behind TLS-terminating FE
 proxy.

Treat apps.f0xx.org and sibling public vhosts as HTTPS when PHP sees plain HTTP on port 80.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 platform/shared_session.php | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/platform/shared_session.php b/platform/shared_session.php
index aaf58c2..5ea0f6a 100644
--- a/platform/shared_session.php
+++ b/platform/shared_session.php
@@ -5,20 +5,36 @@ declare(strict_types=1);
  * Shared session for all Android Cast web consoles (crashes, build, …).
  * Same cookie path + session name => one login across sub-apps.
  */
+function platform_is_https_request(): bool
+{
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
+        return true;
+    }
+    $fwd = strtolower(trim((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')));
+    if ($fwd === 'https') {
+        return true;
+    }
+    $front = strtolower(trim((string) ($_SERVER['HTTP_FRONT_END_HTTPS'] ?? '')));
+    if ($front === 'on') {
+        return true;
+    }
+    // Public vhosts are TLS-terminated at the FE; upstream PHP only sees HTTP :80.
+    $host = strtolower(preg_replace('/:\d+$/', '', (string) ($_SERVER['HTTP_HOST'] ?? '')));
+    return in_array($host, ['apps.f0xx.org', 's.f0xx.org', 'notify.f0xx.org'], true);
+}
+
 function platform_start_session(string $sessionName = 'ac_crash_sess', string $cookiePath = '/app/androidcast_project'): void
 {
     if (session_status() === PHP_SESSION_ACTIVE) {
         return;
     }
     session_name($sessionName);
-    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
-        || strtolower((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')) === 'https';
     session_set_cookie_params([
         'lifetime' => 0,
         'path' => $cookiePath,
         'httponly' => true,
         'samesite' => 'Lax',
-        'secure' => $secure,
+        'secure' => platform_is_https_request(),
     ]);
     session_start();
 }