fix(auth): keep refresh sessions alive on HTTP (#14252)

* fix(auth): keep refresh sessions alive on HTTP

* fix(auth): use supported Vite token expiry injection

* fix(auth): make Vite env injection Playwright-safe

Author: erichare

.secrets.baseline

@@ -2587,7 +2587,7 @@
         "filename": "src/frontend/src/constants/constants.ts",
         "hashed_secret": "c04f8fbf55c9096907a982750b1c6b0e4c1dd658",
         "is_verified": false,
-        "line_number": 952,
+        "line_number": 962,
         "is_secret": false
       }
     ],

docs/docs/Develop/api-keys-and-authentication.mdx

@@ -451,17 +451,20 @@ LANGFLOW_CORS_ALLOW_METHODS=["GET","POST","PUT"]
 ```
 :::
 
-###  LANGFLOW_ACCESS_* {#session-cookie-hardening}
+### LANGFLOW_ACCESS_* and LANGFLOW_REFRESH_* {#session-cookie-hardening}
 
-For a shared or public deployment served over HTTPS, harden the access-token cookie. These default to permissive values for local HTTP development and for the current frontend, which reads the access token in JavaScript.
+For a shared or public deployment served over HTTPS, harden the session cookies. These default to values that support local HTTP development and same-site deployments. The current frontend reads the access token in JavaScript, while the refresh token remains `HttpOnly`.
 
-The refresh-token cookie is `HttpOnly` + `Secure` + `SameSite` by default.
+Set both `LANGFLOW_ACCESS_SECURE` and `LANGFLOW_REFRESH_SECURE` to `True` for HTTPS deployments. Cross-site HTTPS deployments must also set `LANGFLOW_REFRESH_SAME_SITE=none`.
 
 | Variable | Format | Default | Description |
 |----------|--------|---------|-------------|
 | `LANGFLOW_ACCESS_SECURE` | Boolean | `False` | When `true`, the `access_token_lf` cookie is sent only over HTTPS. Recommended `true` for any HTTPS deployment. |
 | `LANGFLOW_ACCESS_HTTPONLY` | Boolean | `False` | When `true`, the `access_token_lf` cookie is not readable by JavaScript. The default is `false` because the bundled frontend currently reads this cookie in JavaScript. |
 | `LANGFLOW_ACCESS_SAME_SITE` | String | `lax` | The `SameSite` attribute of the access-token cookie (`lax`, `strict`, or `none`). |
+| `LANGFLOW_REFRESH_SECURE` | Boolean | `False` | When `true`, the `refresh_token_lf` cookie is sent only over HTTPS. Set this to `true` for any HTTPS deployment. |
+| `LANGFLOW_REFRESH_HTTPONLY` | Boolean | `True` | When `true`, the `refresh_token_lf` cookie is not readable by JavaScript. |
+| `LANGFLOW_REFRESH_SAME_SITE` | String | `lax` | The `SameSite` attribute of the refresh-token cookie (`lax`, `strict`, or `none`). |
 
 ### LANGFLOW_RATE_LIMIT_* {#login-rate-limiting}
 

src/backend/tests/unit/test_security_cors.py

@@ -438,35 +438,30 @@ async def test_refresh_token_valid_flow(self):
                         # user_id is converted to string in JWT payload, then back to UUID in service
                         mock_create_tokens.assert_called_once_with(str(user_id), mock_db)
 
-    def test_refresh_token_samesite_setting_current_behavior(self):
-        """Test current refresh token SameSite settings (warns about security)."""
+    def test_refresh_cookie_defaults_support_same_site_http(self):
+        """Refresh cookies use the same safe, HTTP-compatible defaults as access cookies."""
         from lfx.services.settings.auth import AuthSettings
 
         with tempfile.TemporaryDirectory() as temp_dir, patch.dict(os.environ, {"LANGFLOW_CONFIG_DIR": temp_dir}):
             auth_settings = AuthSettings(CONFIG_DIR=temp_dir)
-            # Current behavior: refresh token uses 'none' (allows cross-site)
-            assert auth_settings.REFRESH_SAME_SITE == "none"  # Current: allows cross-site (less secure)
-            assert auth_settings.ACCESS_SAME_SITE == "lax"  # Access token is already lax (good)
+            assert auth_settings.REFRESH_SAME_SITE == "lax"
+            assert auth_settings.REFRESH_SECURE is False
+            assert auth_settings.ACCESS_SAME_SITE == "lax"
+            assert auth_settings.ACCESS_SECURE is False
             assert auth_settings.ACCESS_HTTPONLY is True
 
-            # Warn about security implications
-            warnings.warn(
-                "SECURITY WARNING: Refresh tokens currently use SameSite=none which allows "
-                "cross-site requests. This should be changed to 'lax' or 'strict' in production. "
-                "In v1.7, this will default to 'lax' for better security.",
-                UserWarning,
-                stacklevel=2,
-            )
+    def test_refresh_cookie_cross_site_https_can_be_enabled(self):
+        """Operators can retain cross-site HTTPS refresh cookies explicitly."""
+        from lfx.services.settings.auth import AuthSettings
 
-    @pytest.mark.skip(reason="Uncomment in v1.7 - represents future secure SameSite behavior")
-    def test_refresh_token_samesite_setting_future_secure(self):
-        """Test future secure refresh token SameSite settings (skip until v1.7)."""
-        # Future secure behavior (uncomment in v1.7):
-        # from langflow.services.settings.auth import AuthSettings
-        # with tempfile.TemporaryDirectory() as temp_dir, patch.dict(os.environ, {"LANGFLOW_CONFIG_DIR": temp_dir}):
-        #     auth_settings = AuthSettings(CONFIG_DIR=temp_dir)
-        #     assert auth_settings.REFRESH_SAME_SITE == "lax"  # Secure default
-        #     assert auth_settings.ACCESS_SAME_SITE == "lax"
+        with tempfile.TemporaryDirectory() as temp_dir:
+            auth_settings = AuthSettings(
+                CONFIG_DIR=temp_dir,
+                REFRESH_SAME_SITE="none",
+                REFRESH_SECURE=True,
+            )
+            assert auth_settings.REFRESH_SAME_SITE == "none"
+            assert auth_settings.REFRESH_SECURE is True
 
 
 class TestCORSIntegration:

src/frontend/src/constants/__tests__/auth-token-expiration.test.ts

@@ -0,0 +1,50 @@
+import {
+  ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY,
+  createAccessTokenExpireSecondsDefinition,
+} from "../../../vite-env-definitions";
+
+describe("authentication token refresh timing", () => {
+  const originalAccessTokenExpiry = process.env.ACCESS_TOKEN_EXPIRE_SECONDS;
+
+  afterEach(() => {
+    if (originalAccessTokenExpiry === undefined) {
+      delete process.env.ACCESS_TOKEN_EXPIRE_SECONDS;
+    } else {
+      process.env.ACCESS_TOKEN_EXPIRE_SECONDS = originalAccessTokenExpiry;
+    }
+    jest.resetModules();
+  });
+
+  it("defaults to refreshing 10% before the one-hour backend expiry", async () => {
+    expect(ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY).toBe(
+      "__LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS__",
+    );
+    const definitions = createAccessTokenExpireSecondsDefinition();
+    expect(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]).toBe("3600");
+    process.env.ACCESS_TOKEN_EXPIRE_SECONDS = String(
+      JSON.parse(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]),
+    );
+    jest.resetModules();
+
+    const { LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV } = await import(
+      "../constants"
+    );
+
+    expect(LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV).toBe(3240);
+  });
+
+  it("refreshes 10% before a configured expiry", async () => {
+    const definitions = createAccessTokenExpireSecondsDefinition("7200");
+    expect(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]).toBe('"7200"');
+    process.env.ACCESS_TOKEN_EXPIRE_SECONDS = String(
+      JSON.parse(definitions[ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]),
+    );
+    jest.resetModules();
+
+    const { LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV } = await import(
+      "../constants"
+    );
+
+    expect(LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV).toBe(6480);
+  });
+});

src/frontend/src/constants/constants.ts

@@ -7,23 +7,23 @@ import {
 import { customDefaultShortcuts } from "../customization/constants";
 import type { languageMap } from "../types/components";
 
+declare const __LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS__: string | number;
+declare const __LANGFLOW_AUTO_LOGIN__: string | boolean;
+
 export const DEFAULT_SESSION_NAME = "Default Session";
 export const NEW_SESSION_NAME = "New Session";
 export const SLIDING_TRANSITION_MS = 300;
 
 const getEnvVar = <T = string | undefined>(
   key: string,
+  viteValue: T | undefined,
   defaultValue?: T,
 ): T | undefined => {
-  if (typeof process !== "undefined" && process.env) {
-    return (process.env[key] as T) ?? defaultValue;
-  }
-  try {
-    const value = new Function(`return import.meta.env?.${key}`)() as T;
-    return value ?? defaultValue;
-  } catch {
-    return defaultValue;
-  }
+  const processValue =
+    typeof process !== "undefined" && process.env
+      ? (process.env[key] as T | undefined)
+      : undefined;
+  return processValue ?? viteValue ?? defaultValue;
 };
 
 /**
@@ -881,9 +881,19 @@ export const LANGFLOW_AUTO_LOGIN_OPTION = "auto_login_lf";
 export const LANGFLOW_REFRESH_TOKEN = "refresh_token_lf";
 
 export const LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS = 60 * 60 - 60 * 60 * 0.1;
+const viteAccessTokenExpireSeconds =
+  typeof __LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS__ === "undefined"
+    ? undefined
+    : __LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS__;
+const configuredAccessTokenExpireSeconds = Number(
+  getEnvVar<string | number>(
+    "ACCESS_TOKEN_EXPIRE_SECONDS",
+    viteAccessTokenExpireSeconds,
+    60 * 60,
+  ),
+);
 export const LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV =
-  Number(getEnvVar("ACCESS_TOKEN_EXPIRE_SECONDS", 60)) -
-  Number(getEnvVar("ACCESS_TOKEN_EXPIRE_SECONDS", 60)) * 0.1;
+  configuredAccessTokenExpireSeconds - configuredAccessTokenExpireSeconds * 0.1;
 export const TEXT_FIELD_TYPES: string[] = ["str", "SecretStr"];
 export const NODE_WIDTH = 384;
 export const NODE_HEIGHT = NODE_WIDTH * 3;
@@ -958,9 +968,16 @@ export const POLLING_MESSAGES = {
 
 export const BUILD_POLLING_INTERVAL = 25;
 
+const viteAutoLogin =
+  typeof __LANGFLOW_AUTO_LOGIN__ === "undefined"
+    ? undefined
+    : __LANGFLOW_AUTO_LOGIN__;
+const autoLoginEnv = getEnvVar<string | boolean>(
+  "LANGFLOW_AUTO_LOGIN",
+  viteAutoLogin,
+);
 export const IS_AUTO_LOGIN =
-  !getEnvVar("LANGFLOW_AUTO_LOGIN") ||
-  String(getEnvVar("LANGFLOW_AUTO_LOGIN"))?.toLowerCase() !== "false";
+  !autoLoginEnv || String(autoLoginEnv).toLowerCase() !== "false";
 
 export const AUTO_LOGIN_RETRY_DELAY = 2000;
 export const AUTO_LOGIN_MAX_RETRY_DELAY = 60000;

src/frontend/vite-env-definitions.ts

@@ -0,0 +1,11 @@
+export const ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY =
+  "__LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS__";
+export const DEFAULT_ACCESS_TOKEN_EXPIRE_SECONDS = 60 * 60;
+
+export const createAccessTokenExpireSecondsDefinition = (
+  configuredValue?: string,
+) => ({
+  [ACCESS_TOKEN_EXPIRE_SECONDS_ENV_KEY]: JSON.stringify(
+    configuredValue ?? DEFAULT_ACCESS_TOKEN_EXPIRE_SECONDS,
+  ),
+});

src/frontend/vite.config.mts

@@ -11,6 +11,7 @@ import {
   PORT,
   PROXY_TARGET,
 } from "./src/customization/config-constants";
+import { createAccessTokenExpireSecondsDefinition } from "./vite-env-definitions";
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), "");
@@ -44,14 +45,14 @@ export default defineConfig(({ mode }) => {
       outDir: "build",
     },
     define: {
+      ...createAccessTokenExpireSecondsDefinition(
+        envLangflow.ACCESS_TOKEN_EXPIRE_SECONDS,
+      ),
       "import.meta.env.BACKEND_URL": JSON.stringify(
         envLangflow.BACKEND_URL ?? "http://localhost:7860",
       ),
-      "import.meta.env.ACCESS_TOKEN_EXPIRE_SECONDS": JSON.stringify(
-        envLangflow.ACCESS_TOKEN_EXPIRE_SECONDS ?? 60,
-      ),
       "import.meta.env.CI": JSON.stringify(envLangflow.CI ?? false),
-      "import.meta.env.LANGFLOW_AUTO_LOGIN": JSON.stringify(
+      __LANGFLOW_AUTO_LOGIN__: JSON.stringify(
         envLangflow.LANGFLOW_AUTO_LOGIN ?? true,
       ),
       "import.meta.env.LANGFLOW_MCP_COMPOSER_ENABLED": JSON.stringify(

src/lfx/src/lfx/services/settings/auth.py

@@ -123,9 +123,9 @@ class AuthSettings(BaseSettings):
     # Store password as SecretStr to prevent accidental plaintext exposure
     SUPERUSER_PASSWORD: SecretStr = Field(default=DEFAULT_SUPERUSER_PASSWORD)
 
-    REFRESH_SAME_SITE: Literal["lax", "strict", "none"] = "none"
+    REFRESH_SAME_SITE: Literal["lax", "strict", "none"] = "lax"
     """The SameSite attribute of the refresh token cookie."""
-    REFRESH_SECURE: bool = True
+    REFRESH_SECURE: bool = False
     """The Secure attribute of the refresh token cookie."""
     REFRESH_HTTPONLY: bool = True
     """The HttpOnly attribute of the refresh token cookie."""