From e3b11376cb93a5637e192dea7dc1f375f5a75bf6 Mon Sep 17 00:00:00 2001
From: Fidel Coria <fidel.coria@aa.com>
Date: Wed, 22 Dec 2021 10:22:12 -0600
Subject: [PATCH] fix: enforce cookie ssl in production

Signed-off-by: Fidel Coria <fidel.coria@aa.com>
---
 plugins/auth-backend/src/service/router.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 6a96d421da..6451207d2d 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -68,7 +68,8 @@ export async function createRouter(
   if (secret) {
     router.use(cookieParser(secret));
     // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    const enforceCookieSSL = process.env.NODE_ENV === 'production';
+    router.use(session({ secret, saveUninitialized: false, resave: false, cookie: { secure: enforceCookieSSL } }));
     router.use(passport.initialize());
     router.use(passport.session());
   } else {