core: remove outdated session.secure option

This commit is contained in:
undefined committed 2023-01-24 14:53:57 +08:00
1 parent c989d1291d
commit 78be1d6fc5
3 files changed
+1 -4

No files matched your search

+1 -2
View File
@@ -75,10 +75,9 @@ export default async (ctx: KoaContext, next: Next) => {
if (!request.websocket) {
const options: any = {
expires: new Date(Date.now() + expireSeconds * 1000),
secure: !!system.get('session.secure'),
httpOnly: false,
};
if (system.get('session.domain')) {
if (system.get('session.domain') && ctx.request.secure && ctx.request.host.endsWith(system.get('session.domain'))) {
options.domain = system.get('session.domain');
options.sameSite = 'none';
options.secure = true;