feat: Enhance session cookie domain configuration for multi-environment support

- Add dynamic domain configuration for session cookies in production
- Support both Vercel Pages and custom domain environments
- Implement secure cookie settings based on environment
- Add debug logging for cookie domain and security settings

commit: 3a0a9252b1a67f5aab3933b636648e62df7dd871
author: Kit · 20mo ago · 2025-02-15 07:03 UTC
parent: 8d5ef03
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

1 file · +20 -0

M src/lib/api/session.cookie.ts +20 -0


@@ -2,9 +2,19 @@ import type { Cookies } from "@sveltejs/kit";
2	2
3	3		export function setSessionTokenCookie({ cookies }: { cookies: Cookies }, token: string, expiresAt: number): void {
4	4		console.debug("Setting session cookie with expiry:", new Date(expiresAt));
	5	+
	6	+	// Get the current domain based on environment and host
	7	+	const domain = process.env.NODE_ENV === 'production'
	8	+	? (process.env.VERCEL_URL?.includes('pages.dev') ? '.pdraim.pages.dev' : '.pdraim.org')
	9	+	: undefined; // Use default domain in development
	10	+
	11	+	console.debug("Setting cookie for domain:", domain);
	12	+
5	13		cookies.set("session", token, {
6	14		httpOnly: true,
7	15		sameSite: "lax",
	16	+	secure: process.env.NODE_ENV === 'production', // Only use secure in production
	17	+	domain, // Set domain based on environment
8	18		expires: new Date(expiresAt),
9	19		path: "/"
10	20		});

@@ -12,9 +22,19 @@ export function setSessionTokenCookie({ cookies }: { cookies: Cookies }, token:
12	22
13	23		export function deleteSessionTokenCookie({ cookies }: { cookies: Cookies }): void {
14	24		console.debug("Deleting session cookie");
	25	+
	26	+	// Get the current domain based on environment and host
	27	+	const domain = process.env.NODE_ENV === 'production'
	28	+	? (process.env.VERCEL_URL?.includes('pages.dev') ? '.pdraim.pages.dev' : '.pdraim.org')
	29	+	: undefined; // Use default domain in development
	30	+
	31	+	console.debug("Deleting cookie for domain:", domain);
	32	+
15	33		cookies.set("session", "", {
16	34		httpOnly: true,
17	35		sameSite: "lax",
	36	+	secure: process.env.NODE_ENV === 'production', // Only use secure in production
	37	+	domain, // Set domain based on environment
18	38		maxAge: 0,
19	39		path: "/"
20	40		});


@@ -2,9 +2,19 @@ import type { Cookies } from "@sveltejs/kit";
2		2
3	export function setSessionTokenCookie({ cookies }: { cookies: Cookies }, token: string, expiresAt: number): void {	3		export function setSessionTokenCookie({ cookies }: { cookies: Cookies }, token: string, expiresAt: number): void {
4	console.debug("Setting session cookie with expiry:", new Date(expiresAt));	4		console.debug("Setting session cookie with expiry:", new Date(expiresAt));
		5	+
		6	+	// Get the current domain based on environment and host
		7	+	const domain = process.env.NODE_ENV === 'production'
		8	+	? (process.env.VERCEL_URL?.includes('pages.dev') ? '.pdraim.pages.dev' : '.pdraim.org')
		9	+	: undefined; // Use default domain in development
		10	+
		11	+	console.debug("Setting cookie for domain:", domain);
		12	+
5	cookies.set("session", token, {	13		cookies.set("session", token, {
6	httpOnly: true,	14		httpOnly: true,
7	sameSite: "lax",	15		sameSite: "lax",
		16	+	secure: process.env.NODE_ENV === 'production', // Only use secure in production
		17	+	domain, // Set domain based on environment
8	expires: new Date(expiresAt),	18		expires: new Date(expiresAt),
9	path: "/"	19		path: "/"
10	});	20		});

@@ -12,9 +22,19 @@ export function setSessionTokenCookie({ cookies }: { cookies: Cookies }, token:
12		22
13	export function deleteSessionTokenCookie({ cookies }: { cookies: Cookies }): void {	23		export function deleteSessionTokenCookie({ cookies }: { cookies: Cookies }): void {
14	console.debug("Deleting session cookie");	24		console.debug("Deleting session cookie");
		25	+
		26	+	// Get the current domain based on environment and host
		27	+	const domain = process.env.NODE_ENV === 'production'
		28	+	? (process.env.VERCEL_URL?.includes('pages.dev') ? '.pdraim.pages.dev' : '.pdraim.org')
		29	+	: undefined; // Use default domain in development
		30	+
		31	+	console.debug("Deleting cookie for domain:", domain);
		32	+
15	cookies.set("session", "", {	33		cookies.set("session", "", {
16	httpOnly: true,	34		httpOnly: true,
17	sameSite: "lax",	35		sameSite: "lax",
		36	+	secure: process.env.NODE_ENV === 'production', // Only use secure in production
		37	+	domain, // Set domain based on environment
18	maxAge: 0,	38		maxAge: 0,
19	path: "/"	39		path: "/"
20	});	40		});