test

Author: mjaydenkim

frontend/src/components/AuthManager/AuthManager.tsx

@@ -77,14 +77,11 @@ const AuthManager = () => {
 
   // SSO Callback handler - fetches profile and JWT after successful SSO login
   const handleSSOCallback = async (event?: React.FormEvent<HTMLFormElement>) => {
-    if (event) {
-      event.preventDefault();
-    }
     try {
       const response = await fetch(
         `${process.env.REACT_APP_SERVER_URL}/api/sso/profile`,
         {
-          credentials: 'include', // CRITICAL: Sends session cookie
+          credentials: 'include', // Send session cookie
         }
       );
 

server/src/auth/session.ts

@@ -24,7 +24,7 @@ export const sessionMiddleware = session({
   name: 'carriage.sid', // Custom session cookie name
   cookie: {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production', // HTTPS only in production
+    secure: true, // HTTPS only in production
     // In production the frontend (Netlify) and backend (Vercel) are on different sites,
     // so we must allow the session cookie to be sent on cross-site XHR/fetch requests.
     // SameSite=Lax works for localhost (same-site) but *blocks* these requests in prod.