From 73ebd6ad495b680302ff95b5c6f8e58cf50d3ce9 Mon Sep 17 00:00:00 2001
From: Nathan FONTEYNE <nathan.fonteyne@axians.com>
Date: Wed, 8 Jul 2026 11:28:23 +0200
Subject: [PATCH] update: dev env

---
 src/auth/session.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/auth/session.js b/src/auth/session.js
index 5684ee7..e3d8108 100644
--- a/src/auth/session.js
+++ b/src/auth/session.js
@@ -16,7 +16,11 @@ module.exports = session({
   cookie: {
     httpOnly: true,
     sameSite: 'lax',
-    secure: config.nodeEnv === 'production',
+    // Never mark the cookie Secure in dev-bypass mode: it's meant to be tested
+    // over plain http://localhost, and browsers silently drop Secure cookies
+    // on non-HTTPS origins, which would otherwise cause an endless redirect
+    // back to /auth/login after a seemingly successful dev login.
+    secure: config.nodeEnv === 'production' && !config.devBypassAuth,
     maxAge: 1000 * 60 * 60 * 24 * 30,
   },
 });