21 lines
774 B
Markdown
21 lines
774 B
Markdown
# V4.2.4 – VPN Admin Cookie Fix
|
||
|
||
The public customer portal and the private Customer-Service admin UI now have independent cookie security modes.
|
||
|
||
Recommended deployment:
|
||
|
||
```env
|
||
# Game admin on VPN/direct HTTP; automatically Secure when placed behind HTTPS.
|
||
ADMIN_COOKIE_SECURE=auto
|
||
|
||
# Public portal remains HTTPS-only.
|
||
CS_COOKIE_SECURE=true
|
||
|
||
# Customer-Service admin on VPN/direct HTTP; automatically Secure behind HTTPS.
|
||
CS_ADMIN_COOKIE_SECURE=auto
|
||
```
|
||
|
||
`auto` detects TLS or `X-Forwarded-Proto: https`. A direct HTTP connection through an encrypted VPN therefore receives a non-Secure HttpOnly admin cookie, while an HTTPS reverse proxy receives a Secure cookie.
|
||
|
||
The public customer session remains independent and HTTPS-only. HSTS is emitted only on HTTPS requests.
|