From e482d56ef5978c0971d134669715cef9678e1ef0 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Sun, 5 Jul 2026 19:12:53 +0200 Subject: [PATCH] fix(session): honor X-Forwarded-Proto; widen auth route matching Secure session cookies behind TLS-terminating FE. resolve_console_route recognizes /two-factor/approve and /api/two-factor/poll. Co-authored-by: Cursor --- platform/shared_session.php | 4 +++- src/bootstrap.php | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/platform/shared_session.php b/platform/shared_session.php index 0de7b19..aaf58c2 100644 --- a/platform/shared_session.php +++ b/platform/shared_session.php @@ -11,12 +11,14 @@ function platform_start_session(string $sessionName = 'ac_crash_sess', string $c return; } session_name($sessionName); + $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') + || strtolower((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')) === 'https'; session_set_cookie_params([ 'lifetime' => 0, 'path' => $cookiePath, 'httponly' => true, 'samesite' => 'Lax', - 'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'), + 'secure' => $secure, ]); session_start(); } diff --git a/src/bootstrap.php b/src/bootstrap.php index a9a08ac..a2e9d4d 100644 --- a/src/bootstrap.php +++ b/src/bootstrap.php @@ -119,7 +119,7 @@ function resolve_console_route(string $uri): string { if ($projectRoot !== '' && str_starts_with($uri, $projectRoot)) { $suffix = substr($uri, strlen($projectRoot)) ?: '/'; $candidate = rtrim(strtok($suffix, '?') ?: '/', '/') ?: '/'; - if (preg_match('#^/(login|logout|register|two-factor|verify-email)(?:/|$)#', $candidate)) { + if (preg_match('#^/(login|logout|register|verify-email|two-factor(?:/approve)?|api/two-factor(?:/poll)?)(/|$)#', $candidate)) { return $candidate; } }