core: remove outdated session.secure option

packages/hydrooj/src/interface.ts

@@ -32,7 +32,6 @@ export interface SystemKeys {
     'limit.problem_files_max': number,
     'problem.categories': string,
     'session.keys': string[],
-    'session.secure': boolean,
     'session.saved_expire_seconds': number,
     'session.unsaved_expire_seconds': number,
     'user.quota': number,

packages/hydrooj/src/model/setting.ts

@@ -232,7 +232,6 @@ SystemSetting(
     Setting('setting_basic', 'pagination.training', 10, 'number', 'pagination.training', 'Trainings per page'),
     Setting('setting_basic', 'pagination.reply', 50, 'number', 'pagination.reply', 'Replies per page'),
     Setting('setting_session', 'session.keys', [String.random(32)], 'text', 'session.keys', 'session.keys', FLAG_HIDDEN),
-    Setting('setting_session', 'session.secure', false, 'boolean', 'session.secure', 'session.secure', FLAG_HIDDEN),
     Setting('setting_session', 'session.domain', '', 'text', 'session.domain', 'session.domain', FLAG_HIDDEN),
     Setting('setting_session', 'session.saved_expire_seconds', 3600 * 24 * 30,
         'number', 'session.saved_expire_seconds', 'Saved session expire seconds'),

packages/hydrooj/src/service/layers/base.ts

@@ -75,10 +75,9 @@ export default async (ctx: KoaContext, next: Next) => {
     if (!request.websocket) {
         const options: any = {
             expires: new Date(Date.now() + expireSeconds * 1000),
-            secure: !!system.get('session.secure'),
             httpOnly: false,
         };
-        if (system.get('session.domain')) {
+        if (system.get('session.domain') && ctx.request.secure && ctx.request.host.endsWith(system.get('session.domain'))) {
             options.domain = system.get('session.domain');
             options.sameSite = 'none';
             options.secure = true;