From 5801adbd18509948219c4b8b0b17a43b1892d8f7 Mon Sep 17 00:00:00 2001
From: Fidel Coria <fidel.coria@aa.com>
Date: Wed, 22 Dec 2021 10:47:36 -0600
Subject: [PATCH] use authUrl for condition

Signed-off-by: Fidel Coria <fidel.coria@aa.com>
---
 plugins/auth-backend/src/service/router.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 6451207d2d..deef6ddcf0 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -68,8 +68,15 @@ export async function createRouter(
   if (secret) {
     router.use(cookieParser(secret));
     // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    const enforceCookieSSL = process.env.NODE_ENV === 'production';
-    router.use(session({ secret, saveUninitialized: false, resave: false, cookie: { secure: enforceCookieSSL } }));
+    const enforceCookieSSL = authUrl.startsWith('https');
+    router.use(
+      session({
+        secret,
+        saveUninitialized: false,
+        resave: false,
+        cookie: { secure: enforceCookieSSL },
+      }),
+    );
     router.use(passport.initialize());
     router.use(passport.session());
   } else {