From 7e87afa3ec1cf9b5b904287c3db5c8d68cfe7d32 Mon Sep 17 00:00:00 2001 From: David Montero Crespo Date: Fri, 6 Mar 2026 21:03:51 -0300 Subject: [PATCH] fix: Google OAuth redirects to production URL after login - FRONTEND_URL and COOKIE_SECURE are now read from settings (env vars) - Add COOKIE_SECURE config field (false by default, true in prod) - backend/.env sets FRONTEND_URL=https://www.velxio.dev and COOKIE_SECURE=true Co-Authored-By: Claude Sonnet 4.6 --- backend/app/api/routes/auth.py | 2 +- backend/app/core/config.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/app/api/routes/auth.py b/backend/app/api/routes/auth.py index aa44603d..77f30c6a 100644 --- a/backend/app/api/routes/auth.py +++ b/backend/app/api/routes/auth.py @@ -23,7 +23,7 @@ def _set_auth_cookie(response: Response, token: str) -> None: httponly=True, samesite="lax", max_age=settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60, - secure=False, # set True in production with HTTPS + secure=settings.COOKIE_SECURE, ) diff --git a/backend/app/core/config.py b/backend/app/core/config.py index 833a3a86..8a5e086e 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -9,6 +9,8 @@ class Settings(BaseSettings): GOOGLE_CLIENT_SECRET: str = "" GOOGLE_REDIRECT_URI: str = "http://localhost:8001/api/auth/google/callback" FRONTEND_URL: str = "http://localhost:5173" + # Set to true in production (HTTPS). Controls the Secure flag on the JWT cookie. + COOKIE_SECURE: bool = False ACCESS_TOKEN_EXPIRE_MINUTES: int = 10080 # 7 days model_config = {"env_file": ".env", "env_file_encoding": "utf-8"}