From 00eac1457ce35d55981320db46c74277cc90a060 Mon Sep 17 00:00:00 2001
From: Elijah <elijah.kuntz@gmail.com>
Date: Sat, 27 Jun 2026 20:21:20 -0700
Subject: [PATCH] Fix login failure over HTTP by disabling secure cookie flag
 by default

---
 src/lib/auth.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index c22eaaf..2a3182d 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -9,7 +9,7 @@ const sessionOptions: SessionOptions = {
   password: process.env.SESSION_SECRET || "dev-session-secret-change-in-production-must-be-32-chars",
   cookieName: "study-app-session",
   cookieOptions: {
-    secure: process.env.NODE_ENV === "production",
+    secure: process.env.NODE_ENV === "production" && process.env.SECURE_COOKIES === "true",
     httpOnly: true,
     sameSite: "lax" as const,
   },