fix: OIDC forced secure cookie (#13217)

closes #13180

server/utils/LogoutTokenStore.ts

@@ -109,7 +109,7 @@ export class LogoutTokenStore {
     return {
       httpOnly: true,
       sameSite: "lax" as const,
-      secure: env.isProduction,
+      secure: ctx.request.secure,
       path: this.cookiePath,
       domain: getCookieDomain(ctx.request.hostname, env.isCloudHosted),
       expires,

server/utils/passport.ts

@@ -185,7 +185,7 @@ export class StateStore {
     context.cookies.set(OAUTH_CSRF_COOKIE, csrfNonce, {
       httpOnly: true,
       sameSite: "lax",
-      secure: env.isProduction,
+      secure: context.request.secure,
       expires: addMinutes(new Date(), 10),
       domain: getCookieDomain(context.hostname, env.isCloudHosted),
     });
@@ -203,7 +203,7 @@ export class StateStore {
     context.cookies.set(OAUTH_CSRF_COOKIE, "", {
       httpOnly: true,
       sameSite: "lax",
-      secure: env.isProduction,
+      secure: context.request.secure,
       expires: subMinutes(new Date(), 1),
       domain: getCookieDomain(context.hostname, env.isCloudHosted),
     });