jason 69b7262535 Fix 401 Unauthorized on all API calls after login (HTTP installs) ...

Root cause: cookie was set with Secure=true whenever NODE_ENV=production.
Browsers refuse to send Secure cookies over plain HTTP, so the session
cookie was dropped on every request after login — causing every protected
endpoint to return 401.

Fix: replace the NODE_ENV check with an explicit COOKIE_SECURE env var
(default false). Set COOKIE_SECURE=true only when running behind an HTTPS
reverse proxy. Direct HTTP installs (standard Unraid setup) work as-is.

Also updated UNRAID.md to document COOKIE_SECURE with a warning explaining
why it must stay false for plain-HTTP access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-21 22:40:08 -05:00

.claude

Switch auth to plain-text password env var (remove bcrypt)

2026-03-21 22:05:42 -05:00

client

Switch auth to plain-text password env var (remove bcrypt)

2026-03-21 22:05:42 -05:00

prisma

Fix Prisma OpenSSL error on Alpine Linux (Docker)

2026-03-21 22:32:25 -05:00

server

Fix 401 Unauthorized on all API calls after login (HTTP installs)

2026-03-21 22:40:08 -05:00

.env.example

Initial scaffold: full-stack RackMapper application

2026-03-21 21:48:56 -05:00

.gitignore

Initial scaffold: full-stack RackMapper application

2026-03-21 21:48:56 -05:00

.prettierrc

Initial scaffold: full-stack RackMapper application

2026-03-21 21:48:56 -05:00

AGENTS.md

Update documentation to reflect current build state

2026-03-21 22:07:58 -05:00

docker-compose.yml

Switch auth to plain-text password env var (remove bcrypt)

2026-03-21 22:05:42 -05:00

Dockerfile

Fix Prisma OpenSSL error on Alpine Linux (Docker)

2026-03-21 22:32:25 -05:00

package-lock.json

Switch auth to plain-text password env var (remove bcrypt)

2026-03-21 22:05:42 -05:00

package.json

Switch auth to plain-text password env var (remove bcrypt)

2026-03-21 22:05:42 -05:00

RREADME.md

Update documentation to reflect current build state

2026-03-21 22:07:58 -05:00

tsconfig.json

Initial scaffold: full-stack RackMapper application

2026-03-21 21:48:56 -05:00

UNRAID.md

Fix 401 Unauthorized on all API calls after login (HTTP installs)

2026-03-21 22:40:08 -05:00

Description

No description provided

506 KiB

Languages

TypeScript 98.2%

Dockerfile 0.5%

JavaScript 0.5%

CSS 0.4%

Shell 0.2%

Other 0.2%