From aca521b54fffc159c550468ac3b694ee46f053ce Mon Sep 17 00:00:00 2001
From: Nathan FONTEYNE <nathan.fonteyne@axians.com>
Date: Wed, 8 Jul 2026 14:09:52 +0200
Subject: [PATCH] fix: more robust cookie session

---
 src/app.js         |  4 ++++
 src/auth/routes.js | 14 +++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/app.js b/src/app.js
index 78e7f75..ef4a3dd 100644
--- a/src/app.js
+++ b/src/app.js
@@ -8,6 +8,10 @@ const apiRouter = require('./routes');
 function createApp() {
   const app = express();
 
+  // Behind Traefik: without this, req.protocol/req.secure ignore
+  // X-Forwarded-Proto and always report the plain-HTTP hop to the container.
+  app.set('trust proxy', 1);
+
   app.get('/health', (req, res) => res.status(200).json({ status: 'ok' }));
 
   app.use(express.json());
diff --git a/src/auth/routes.js b/src/auth/routes.js
index 78f5473..ea90620 100644
--- a/src/auth/routes.js
+++ b/src/auth/routes.js
@@ -83,7 +83,13 @@ router.get(
       code_challenge_method: 'S256',
     });
 
-    res.redirect(authUrl.href);
+    // Force the session write to complete (and surface any store error)
+    // before sending the redirect, instead of relying on express-session's
+    // implicit save-on-response-end behavior.
+    req.session.save((err) => {
+      if (err) throw err;
+      res.redirect(authUrl.href);
+    });
   })
 );
 
@@ -97,6 +103,12 @@ router.get(
     const oidcConfig = getOidcConfig();
     const pending = req.session.oidc;
     if (!pending) {
+      console.warn(
+        '[auth] /auth/callback reached with no pending OIDC state.',
+        'sessionID:', req.sessionID,
+        'cookie header present:', Boolean(req.headers.cookie),
+        'session keys:', Object.keys(req.session || {}),
+      );
       return res.status(400).send('Session de connexion expirée, réessayez.');
     }