fix: enforce cookie ssl in production

Signed-off-by: Fidel Coria <fidel.coria@aa.com>

plugins/auth-backend/src/service/router.ts

@@ -68,7 +68,8 @@ export async function createRouter(
   if (secret) {
     router.use(cookieParser(secret));
     // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    const enforceCookieSSL = process.env.NODE_ENV === 'production';
+    router.use(session({ secret, saveUninitialized: false, resave: false, cookie: { secure: enforceCookieSSL } }));
     router.use(passport.initialize());
     router.use(passport.session());
   } else {