From dbdfb4a6d2ba04f95d72b7ee2780d14101edf225 Mon Sep 17 00:00:00 2001
From: nulledy <254504350+nulledy@users.noreply.github.com>
Date: Sun, 12 Jul 2026 17:38:17 +0000
Subject: [PATCH] Change JWT cookie expiration to use max_age and have the
 appropriate expiration time based on JWT_SESSION_LENGTH

---
 frigate/api/auth.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/frigate/api/auth.py b/frigate/api/auth.py
index a6a4c65b68..75609ca07f 100644
--- a/frigate/api/auth.py
+++ b/frigate/api/auth.py
@@ -415,7 +415,7 @@ def create_encoded_jwt(user, role, expiration, secret):
     )
 
 
-def set_jwt_cookie(response: Response, cookie_name, encoded_jwt, expiration, secure):
+def set_jwt_cookie(response: Response, cookie_name, encoded_jwt, max_age, secure):
     # TODO: ideally this would set secure as well, but that requires TLS
     # SameSite is intentionally left unset (browsers default to Lax). Setting
     # SameSite=Lax/Strict would stop the cookie from being sent in cross-origin
@@ -427,7 +427,7 @@ def set_jwt_cookie(response: Response, cookie_name, encoded_jwt, expiration, sec
         key=cookie_name,
         value=encoded_jwt,
         httponly=True,
-        expires=expiration,
+        max_age=max_age,
         secure=secure,
     )
 
@@ -762,7 +762,7 @@ def auth(request: Request):
                 success_response,
                 JWT_COOKIE_NAME,
                 new_encoded_jwt,
-                new_expiration,
+                JWT_SESSION_LENGTH,
                 JWT_COOKIE_SECURE,
             )
 
@@ -875,7 +875,7 @@ def login(request: Request, body: AppPostLoginBody):
         encoded_jwt = create_encoded_jwt(user, role, expiration, request.app.jwt_token)
         response = Response("", 200)
         set_jwt_cookie(
-            response, JWT_COOKIE_NAME, encoded_jwt, expiration, JWT_COOKIE_SECURE
+            response, JWT_COOKIE_NAME, encoded_jwt, JWT_SESSION_LENGTH, JWT_COOKIE_SECURE
         )
         # Clear admin_first_time_login flag after successful admin login so the
         # UI stops showing the first-time login documentation link.
@@ -1037,7 +1037,7 @@ async def update_password(
         )
         # Set new JWT cookie on response
         set_jwt_cookie(
-            response, JWT_COOKIE_NAME, encoded_jwt, expiration, JWT_COOKIE_SECURE
+            response, JWT_COOKIE_NAME, encoded_jwt, JWT_SESSION_LENGTH, JWT_COOKIE_SECURE
         )
 
     return response