Josh Hawkins a2e7e5c991 set the secure cookie flag when the request arrived over tls ...

The session cookie only got the Secure flag from auth.cookie_secure, which defaults to false even though TLS is on by default, so browsers would send it over plain HTTP. The cookie is now Secure whenever nginx reports an https scheme, and nginx passes that scheme to the /auth subrequest so refreshed cookies match. cookie_secure still forces the flag for a reverse proxy that terminates TLS in front of plain-HTTP Frigate.

2026-10-18 12:18:58 -05:00

..

local

set the secure cookie flag when the request arrived over tls

2026-10-18 12:18:58 -05:00