fix(auth): use supported Vite token expiry injection

Author: erichare

.secrets.baseline

@@ -2567,23 +2567,23 @@
         "filename": "src/frontend/src/constants/constants.ts",
         "hashed_secret": "19a2fbd0dd38b4097f419c962342ef5e109eab07",
         "is_verified": false,
-        "line_number": 767,
+        "line_number": 764,
         "is_secret": false
       },
       {
         "type": "Secret Keyword",
         "filename": "src/frontend/src/constants/constants.ts",
         "hashed_secret": "3806954324550e26ef5de85d007f1746825a073c",
         "is_verified": false,
-        "line_number": 768,
+        "line_number": 765,
         "is_secret": false
       },
       {
         "type": "Secret Keyword",
         "filename": "src/frontend/src/constants/constants.ts",
         "hashed_secret": "c04f8fbf55c9096907a982750b1c6b0e4c1dd658",
         "is_verified": false,
-        "line_number": 952,
+        "line_number": 955,
         "is_secret": false
       }
     ],
@@ -7242,5 +7242,5 @@
       }
     ]
   },
-  "generated_at": "2026-07-24T14:19:19Z"
+  "generated_at": "2026-07-24T21:27:29Z"
 }

docs/docs/Develop/api-keys-and-authentication.mdx

@@ -451,17 +451,20 @@ LANGFLOW_CORS_ALLOW_METHODS=["GET","POST","PUT"]
 ```
 :::
 
-###  LANGFLOW_ACCESS_* {#session-cookie-hardening}
+### LANGFLOW_ACCESS_* and LANGFLOW_REFRESH_* {#session-cookie-hardening}
 
-For a shared or public deployment served over HTTPS, harden the access-token cookie. These default to permissive values for local HTTP development and for the current frontend, which reads the access token in JavaScript.
+For a shared or public deployment served over HTTPS, harden the session cookies. These default to values that support local HTTP development and same-site deployments. The current frontend reads the access token in JavaScript, while the refresh token remains `HttpOnly`.
 
-The refresh-token cookie is `HttpOnly` + `Secure` + `SameSite` by default.
+Set both `LANGFLOW_ACCESS_SECURE` and `LANGFLOW_REFRESH_SECURE` to `True` for HTTPS deployments. Cross-site HTTPS deployments must also set `LANGFLOW_REFRESH_SAME_SITE=none`.
 
 | Variable | Format | Default | Description |
 |----------|--------|---------|-------------|
 | `LANGFLOW_ACCESS_SECURE` | Boolean | `False` | When `true`, the `access_token_lf` cookie is sent only over HTTPS. Recommended `true` for any HTTPS deployment. |
 | `LANGFLOW_ACCESS_HTTPONLY` | Boolean | `False` | When `true`, the `access_token_lf` cookie is not readable by JavaScript. The default is `false` because the bundled frontend currently reads this cookie in JavaScript. |
 | `LANGFLOW_ACCESS_SAME_SITE` | String | `lax` | The `SameSite` attribute of the access-token cookie (`lax`, `strict`, or `none`). |
+| `LANGFLOW_REFRESH_SECURE` | Boolean | `False` | When `true`, the `refresh_token_lf` cookie is sent only over HTTPS. Set this to `true` for any HTTPS deployment. |
+| `LANGFLOW_REFRESH_HTTPONLY` | Boolean | `True` | When `true`, the `refresh_token_lf` cookie is not readable by JavaScript. |
+| `LANGFLOW_REFRESH_SAME_SITE` | String | `lax` | The `SameSite` attribute of the refresh-token cookie (`lax`, `strict`, or `none`). |
 
 ### LANGFLOW_RATE_LIMIT_* {#login-rate-limiting}
 

src/frontend/src/constants/__tests__/auth-token-expiration.test.ts

@@ -1,3 +1,8 @@
+import {
+  ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY,
+  createAccessTokenExpireSecondsDefinition,
+} from "../../../vite-env-definitions";
+
 describe("authentication token refresh timing", () => {
   const originalAccessTokenExpiry = process.env.ACCESS_TOKEN_EXPIRE_SECONDS;
 
@@ -11,7 +16,11 @@ describe("authentication token refresh timing", () => {
   });
 
   it("defaults to refreshing 10% before the one-hour backend expiry", async () => {
-    delete process.env.ACCESS_TOKEN_EXPIRE_SECONDS;
+    const definitions = createAccessTokenExpireSecondsDefinition();
+    expect(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]).toBe("3600");
+    process.env.ACCESS_TOKEN_EXPIRE_SECONDS = String(
+      JSON.parse(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]),
+    );
     jest.resetModules();
 
     const { LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV } = await import(
@@ -22,7 +31,11 @@ describe("authentication token refresh timing", () => {
   });
 
   it("refreshes 10% before a configured expiry", async () => {
-    process.env.ACCESS_TOKEN_EXPIRE_SECONDS = "7200";
+    const definitions = createAccessTokenExpireSecondsDefinition("7200");
+    expect(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]).toBe('"7200"');
+    process.env.ACCESS_TOKEN_EXPIRE_SECONDS = String(
+      JSON.parse(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]),
+    );
     jest.resetModules();
 
     const { LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV } = await import(

src/frontend/src/constants/constants.ts

@@ -13,17 +13,14 @@ export const SLIDING_TRANSITION_MS = 300;
 
 const getEnvVar = <T = string | undefined>(
   key: string,
+  viteValue: T | undefined,
   defaultValue?: T,
 ): T | undefined => {
-  if (typeof process !== "undefined" && process.env) {
-    return (process.env[key] as T) ?? defaultValue;
-  }
-  try {
-    const value = new Function(`return import.meta.env?.${key}`)() as T;
-    return value ?? defaultValue;
-  } catch {
-    return defaultValue;
-  }
+  const processValue =
+    typeof process !== "undefined" && process.env
+      ? (process.env[key] as T | undefined)
+      : undefined;
+  return processValue ?? viteValue ?? defaultValue;
 };
 
 /**
@@ -881,9 +878,15 @@ export const LANGFLOW_AUTO_LOGIN_OPTION = "auto_login_lf";
 export const LANGFLOW_REFRESH_TOKEN = "refresh_token_lf";
 
 export const LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS = 60 * 60 - 60 * 60 * 0.1;
+const configuredAccessTokenExpireSeconds = Number(
+  getEnvVar<string | number>(
+    "ACCESS_TOKEN_EXPIRE_SECONDS",
+    import.meta.env.ACCESS_TOKEN_EXPIRE_SECONDS,
+    60 * 60,
+  ),
+);
 export const LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV =
-  Number(getEnvVar("ACCESS_TOKEN_EXPIRE_SECONDS", 60 * 60)) -
-  Number(getEnvVar("ACCESS_TOKEN_EXPIRE_SECONDS", 60 * 60)) * 0.1;
+  configuredAccessTokenExpireSeconds - configuredAccessTokenExpireSeconds * 0.1;
 export const TEXT_FIELD_TYPES: string[] = ["str", "SecretStr"];
 export const NODE_WIDTH = 384;
 export const NODE_HEIGHT = NODE_WIDTH * 3;
@@ -958,9 +961,12 @@ export const POLLING_MESSAGES = {
 
 export const BUILD_POLLING_INTERVAL = 25;
 
+const autoLoginEnv = getEnvVar<string | boolean>(
+  "LANGFLOW_AUTO_LOGIN",
+  import.meta.env.LANGFLOW_AUTO_LOGIN,
+);
 export const IS_AUTO_LOGIN =
-  !getEnvVar("LANGFLOW_AUTO_LOGIN") ||
-  String(getEnvVar("LANGFLOW_AUTO_LOGIN"))?.toLowerCase() !== "false";
+  !autoLoginEnv || String(autoLoginEnv).toLowerCase() !== "false";
 
 export const AUTO_LOGIN_RETRY_DELAY = 2000;
 export const AUTO_LOGIN_MAX_RETRY_DELAY = 60000;

src/frontend/vite-env-definitions.ts

@@ -0,0 +1,11 @@
+export const ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY =
+  "import.meta.env.ACCESS_TOKEN_EXPIRE_SECONDS";
+export const DEFAULT_ACCESS_TOKEN_EXPIRE_SECONDS = 60 * 60;
+
+export const createAccessTokenExpireSecondsDefinition = (
+  configuredValue?: string,
+) => ({
+  [ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]: JSON.stringify(
+    configuredValue ?? DEFAULT_ACCESS_TOKEN_EXPIRE_SECONDS,
+  ),
+});

src/frontend/vite.config.mts

@@ -11,6 +11,7 @@ import {
   PORT,
   PROXY_TARGET,
 } from "./src/customization/config-constants";
+import { createAccessTokenExpireSecondsDefinition } from "./vite-env-definitions";
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), "");
@@ -44,12 +45,12 @@ export default defineConfig(({ mode }) => {
       outDir: "build",
     },
     define: {
+      ...createAccessTokenExpireSecondsDefinition(
+        envLangflow.ACCESS_TOKEN_EXPIRE_SECONDS,
+      ),
       "import.meta.env.BACKEND_URL": JSON.stringify(
         envLangflow.BACKEND_URL ?? "http://localhost:7860",
       ),
-      "import.meta.env.ACCESS_TOKEN_EXPIRE_SECONDS": JSON.stringify(
-        envLangflow.ACCESS_TOKEN_EXPIRE_SECONDS ?? 60 * 60,
-      ),
       "import.meta.env.CI": JSON.stringify(envLangflow.CI ?? false),
       "import.meta.env.LANGFLOW_AUTO_LOGIN": JSON.stringify(
         envLangflow.LANGFLOW_AUTO_LOGIN ?? true,