dimitar/spomeni
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: set cookie path to / so admin API routes receive the session

Browse Source 
Cookie path was /admin, but admin API routes live under /api/admin/.
Browser only sends cookies to paths matching the cookie's path, so
all API calls were unauthenticated. Changed path to / for both
cookie creation (login) and deletion (logout).
This commit is contained in:
dimitar 2026-07-29 19:56:16 +02:00
parent 117f9fadfc
commit faa8216716
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/app/api/admin/logout/route.ts
View File

@ -8,7 +8,7 @@ export async function POST() {
httpOnly: true, httpOnly: true,
secure: process.env.NODE_ENV === "production", secure: process.env.NODE_ENV === "production",
sameSite: "lax", sameSite: "lax",
path: "/admin", path: "/",
maxAge: 0, maxAge: 0,
}); });
return res; return res;

2
src/lib/admin-session.ts
View File

@ -69,7 +69,7 @@ export function cookieOptions(value: string) {
httpOnly: true, httpOnly: true,
secure: process.env.NODE_ENV === "production", secure: process.env.NODE_ENV === "production",
sameSite: "lax" as const, sameSite: "lax" as const,
path: "/admin", path: "/",
}; };
} }