fix(auth): enforce PAM account stack and default session cookie to Secure

2026-08-24 10:02:09 +02:00
parent bb5cc8268f
commit f3cb06f0cd
4 changed files with 30 additions and 10 deletions
@@ -316,7 +316,10 @@ skipConfigPrompt:
 		certLine = "# tls_cert: /var/lib/nadir/tls/cert.pem"
 		keyLine = "# tls_key:  /var/lib/nadir/tls/key.pem"
 	} else if isTrustProxy {
-		secureTLSVal = "false"
+		// The proxy terminates TLS, so the browser<->proxy leg is still HTTPS -
+		// the cookie stays Secure. Only the proxy<->nadir hop is plaintext, and
+		// the browser never sees it.
+		secureTLSVal = "true"
 		trustProxyLine = "trust_proxy: true"
 		certLine = "# tls_cert: /var/lib/nadir/tls/cert.pem"
 		keyLine = "# tls_key:  /var/lib/nadir/tls/key.pem"