feat: set cookie to secure and strict

server/src/config.js

@@ -23,9 +23,19 @@ function getUrl(key) {
   return ''
 }
 
-const config = {
-  host: get('HOST', 'localhost'),
-  port: get('PORT', 3000),
+function createConfig() {
+  const isProduction = process.env.NODE_ENV === 'production'
+  const host = get('HOST', 'localhost')
+  const port = Number(get('PORT', 3000))
+  const baseUrl = get('BASE_URL', `http://${host}:${port}`)
+  const url = new URL(baseUrl)
+  return {
+    host,
+    port,
+    baseUrl,
+    domain: url.hostname,
+    protocol: url.protocol,
+    backendUrl: get('BACKEND_URL', baseUrl),
     db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'),
     secret: get('SECRET_KEY', ''),
     isProduction: process.env.NODE_ENV === 'production',
@@ -54,16 +64,18 @@ const config = {
     log: {
       path: get('LOG_PATH', '../logs'),
     },
-}
-
-config.baseUrl = get('BASE_URL', `http://${config.host}:${config.port}`)
-config.backendUrl = get('BACKEND_URL', config.baseUrl)
-config.testing = {
-  enabled: !config.isProduction && process.env.TESTING === 'true',
+    testing: {
+      enabled: !isProduction && process.env.TESTING === 'true',
       username: get('TESTING_USERNAME', ''),
       password: get('TESTING_PASSWORD', ''),
+    },
+  }
 }
 
+const config = createConfig()
+
+console.log(config)
+
 export function getQuestImage(id) {
   return `${config.docker.imagePrefix}${id}`
 }

server/src/middleware/session.js

@@ -9,9 +9,10 @@ export default session({
   saveUninitialized: false,
   rolling: true,
   cookie: {
+    domain: config.domain,
     httpOnly: true,
-    secure: false,
-    sameSite: 'lax',
+    secure: config.protocol === 'https:',
+    sameSite: 'strict',
     maxAge: config.sessionMaxAge,
   },
   store: MongoStore.create({