From b69c59ff08b1a16474aaf7ca3ff14f315903108b Mon Sep 17 00:00:00 2001 From: Trezy Date: Thu, 19 Mar 2026 17:24:19 +0000 Subject: [PATCH] fix: allow HappyView redirect cookie to be read appropriately --- src/auth/routes.rs | 7 +++---- 1 file(s) changed, 3 insertion(s)(+), 4 deletion(s)(-) diff --git a/src/auth/routes.rs b/src/auth/routes.rs --- a/src/auth/routes.rs +++ b/src/auth/routes.rs @@ -47,14 +47,13 @@ .await .map_err(|e| AppError::Internal(format!("OAuth authorize failed: {e}")))?; // Store the redirect URI in a cookie if provided + // Must use SameSite=None for cross-origin requests (e.g., Pentaract calling HappyView) let jar = if let Some(redirect_uri) = query.redirect_uri { let mut cookie = Cookie::new(REDIRECT_COOKIE_NAME, redirect_uri); cookie.set_path("/"); cookie.set_http_only(true); - cookie.set_same_site(axum_extra::extract::cookie::SameSite::Lax); - if state.config.public_url.starts_with("https") { - cookie.set_secure(true); - } + cookie.set_same_site(axum_extra::extract::cookie::SameSite::None); + cookie.set_secure(true); // Required when SameSite=None jar.add(cookie) } else { jar -- tangled.sh