fix(auth): keep refresh sessions alive on HTTP

[erichare]

Summary

• align the frontend refresh fallback with the backend one-hour access-token lifetime, scheduling refresh at 54 minutes instead of 54 seconds
• make refresh-cookie defaults work on same-site HTTP deployments while retaining explicit secure cross-site overrides
• add regression coverage for default and configured refresh timing and cookie settings

Testing

• npm test -- --runInBand src/constants/__tests__/auth-token-expiration.test.ts src/components/authorization/authGuard/__tests__/proactive-refresh.test.tsx
• uv run pytest src/backend/tests/unit/test_auth_settings.py src/backend/tests/unit/test_security_cors.py -q
• npx @biomejs/biome check src/constants/constants.ts src/constants/__tests__/auth-token-expiration.test.ts vite.config.mts
• uv run ruff check src/lfx/src/lfx/services/settings/auth.py src/backend/tests/unit/test_security_cors.py
• uv run ruff format --check src/lfx/src/lfx/services/settings/auth.py src/backend/tests/unit/test_security_cors.py
• npm run build

Addresses LE-2013.

Summary by CodeRabbit

• Security

  • Refresh-token cookies now use safer same-site defaults and do not require HTTPS by default.
  • Cross-site refresh cookies remain available when explicitly configured for secure HTTPS use.

• Authentication

  • Frontend access-token expiration now defaults to a one-hour backend lifetime.
  • Tokens refresh automatically 10% before expiration to help maintain active sessions.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 858f8751-313c-4f85-b3a9-baaa1da9e91f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Refresh-cookie defaults now use same-site lax settings, with explicit cross-site HTTPS configuration covered by tests. Frontend access-token expiry fallbacks now use a one-hour backend default and include calculation tests.

Changes

Refresh Cookie Policy

Layer / File(s)	Summary
Refresh cookie defaults and validation src/lfx/src/lfx/services/settings/auth.py, src/backend/tests/unit/test_security_cors.py	Refresh cookies default to SameSite=Lax and non-secure operation; tests cover these defaults and explicit SameSite=None with secure cookies.

Access-Token Expiry Alignment

Layer / File(s)	Summary
Frontend expiry fallback and tests src/frontend/src/constants/constants.ts, src/frontend/vite.config.mts, src/frontend/src/constants/__tests__/auth-token-expiration.test.ts	Frontend expiry fallbacks use one hour, retain the ten-percent reduction, and test both default and configured backend expiry values.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• langflow-ai/langflow#13699: Updates the /auto_login refresh cookie using the same refresh-cookie security attributes.

Suggested labels: bug, lgtm

Suggested reviewers: cristhianzl, jordanrfrazier

🚥 Pre-merge checks | ✅ 8 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Quality And Coverage	⚠️ Warning	Backend cookie tests are substantive, but frontend coverage misses the Vite-injected env path; it only checks Node process.env, leaving build-time config untested.	Add a frontend test or build assertion that verifies import.meta.env.ACCESS_TOKEN_EXPIRE_SECONDS is injected for both default and custom values.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main auth/cookie change by emphasizing HTTP-friendly refresh sessions, though it omits the frontend refresh-timing update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	PASS: The PR adds real backend and frontend regression tests for the refresh-cookie defaults and token-expiry calculation, and filenames follow repo test conventions.
Test File Naming And Structure	✅ Passed	New tests follow repo conventions: backend uses test_*.py/pytest, frontend uses .test.ts/Jest with descriptive cases and setup/teardown.
Excessive Mock Usage Warning	✅ Passed	Touched tests are mostly env/config driven; the React test mocks only external deps to isolate interval logic, which is appropriate.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/le-2013-auth-refresh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.57%. Comparing base (d4d5592) to head (55a4854).
⚠️ Report is 1 commits behind head on release-1.11.1.

Additional details and impacted files

@@                Coverage Diff                 @@
##           release-1.11.1   #14252      +/-   ##
==================================================
+ Coverage           61.41%   61.57%   +0.15%     
==================================================
  Files                2444     2444              
  Lines              239915   239932      +17     
  Branches            37329    37390      +61     
==================================================
+ Hits               147344   147730     +386     
+ Misses              90804    90435     -369     
  Partials             1767     1767              

Flag	Coverage Δ
backend	68.81% <ø> (+0.99%)	⬆️
frontend	60.02% <100.00%> (-0.03%)	⬇️
lfx	60.01% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/frontend/src/constants/constants.ts	100.00% <100.00%> (+0.09%)	⬆️
src/lfx/src/lfx/services/settings/auth.py	62.16% <100.00%> (ø)

... and 127 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/frontend/src/constants/__tests__/auth-token-expiration.test.ts`:
- Around line 1-34: Extend the authentication token expiration coverage around
LANGFLOW_ACCESS_TOKEN_EXPIRE_SECONDS_ENV to exercise the Vite-injected
import.meta.env.ACCESS_TOKEN_EXPIRE_SECONDS path, not only process.env. Add
focused frontend test or build-level checks for both the default one-hour value
and a configured expiry, verifying each is transformed to the expected 10%-early
refresh value through the actual vite.config.mts injection.

In `@src/frontend/src/constants/constants.ts`:
- Around line 885-886: Update the ACCESS_TOKEN_CLI_EXPIRE_SECONDS handling in
constants.ts (lines 885-886) to use a supported browser/module-level environment
lookup instead of getEnvVar’s invalid new Function import path, preserving
configured expiry values before applying the 10% adjustment. Update the
corresponding environment injection in vite.config.mts (line 51) so the same
supported lookup receives the configured value rather than falling back to the
constant defaults.

In `@src/lfx/src/lfx/services/settings/auth.py`:
- Around line 126-128: Update the REFRESH_SECURE setting in the authentication
settings configuration to default to enabled, while preserving the ability for
development or local deployments to explicitly override it for intentional HTTP
usage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2bf2c75d-fa4a-4388-9027-d51aa317095f

📥 Commits

Reviewing files that changed from the base of the PR and between d4d5592 and 5f87d03.

📒 Files selected for processing (5)

• src/backend/tests/unit/test_security_cors.py
• src/frontend/src/constants/__tests__/auth-token-expiration.test.ts
• src/frontend/src/constants/constants.ts
• src/frontend/vite.config.mts
• src/lfx/src/lfx/services/settings/auth.py

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	47.12% (67100/142381)	70.18% (9433/13441)	45.53% (1540/3382)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
5359	0 💤	0 ❌	0 🔥	20m 37s ⏱️

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft