From 494cb058269e21aac7b25aac7be4892f4724f16c Mon Sep 17 00:00:00 2001 From: Trezy Date: Thu, 19 Mar 2026 13:32:14 -0500 Subject: [PATCH] fix: allow session cookies to work cross origin --- src/auth/routes.rs | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/auth/routes.rs b/src/auth/routes.rs index 045f661..161c04b 100644 --- a/src/auth/routes.rs +++ b/src/auth/routes.rs @@ -92,13 +92,12 @@ async fn callback( .unwrap_or_else(|| "/".to_string()); // Set the session cookie + // Must use SameSite=None for cross-origin requests (e.g., Pentaract calling HappyView) let mut session_cookie = Cookie::new(COOKIE_NAME, did.to_string()); session_cookie.set_path("/"); session_cookie.set_http_only(true); - session_cookie.set_same_site(axum_extra::extract::cookie::SameSite::Lax); - if state.config.public_url.starts_with("https") { - session_cookie.set_secure(true); - } + session_cookie.set_same_site(axum_extra::extract::cookie::SameSite::None); + session_cookie.set_secure(true); // Required when SameSite=None // Remove the redirect cookie let mut redirect_removal = Cookie::from(REDIRECT_COOKIE_NAME); -- 2.51.2