From 48959190a0c3dabc6091ca690e980a3dbe7fbdf3 Mon Sep 17 00:00:00 2001
From: Randall Stillwell <me@randallstillwell.com>
Date: Wed, 15 Apr 2026 14:11:50 -0500
Subject: [PATCH] Fix middleware cookie detection behind HTTPS reverse proxy

getToken() defaults secureCookie to false, so it looks for
"authjs.session-token" cookie. Behind Traefik over HTTPS, Auth.js
sets "__Secure-authjs.session-token". Detect HTTPS via
x-forwarded-proto header and pass secureCookie accordingly.

Made-with: Cursor
---
 src/middleware.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/middleware.ts b/src/middleware.ts
index 7f60dda..220d2f3 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -44,7 +44,14 @@ export async function middleware(req: NextRequest) {
     return NextResponse.next();
   }
 
-  const token = await getToken({ req, secret: process.env.AUTH_SECRET });
+  const secureCookie =
+    req.headers.get("x-forwarded-proto") === "https" ||
+    req.nextUrl.protocol === "https:";
+  const token = await getToken({
+    req,
+    secret: process.env.AUTH_SECRET,
+    secureCookie,
+  });
 
   if (!token) {
     const loginUrl = new URL("/login", req.url);