starred/pocket-id
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-07-16 05:54:01 +03:00
Code Issues 61 Packages Projects Releases 21 Wiki Activity

🐛 Bug Report: Deploy without https cause redirection to login page after setup #639

New Issue
Open
opened 2026-02-04 20:42:36 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-04 20:42:36 +03:00
Owner
Copy Link

Originally created by @PinkD on GitHub (Jan 30, 2026).

Reproduction steps

  1. Follow the installation guide https://pocket-id.org/docs/setup/installation, run with docker-compose, set APP_URL=http://10.0.0.1:1411 in the .env
  2. Visit http://10.0.0.1:1411/setup and do the setup. Click on the Sign Up button. We are redirected to /login page

The setup response provided a Set-Cookie header with the Secure option included. Because the url is not https, the cookie is ignored. So when we visit the /me page without cookie, we are redirected to /login

I modified backend/internal/utils/cookie/add_cookie.go , rebuilt the docker image to test, the issue was fixed.
ref: #130

If disabling secure cookie won't break anything, maybe we should introduce an option to do that for local test without https?

Expected behavior

After finishing setup, we should go to /signup/add-passkey page.

Actual Behavior

We are on the /login page.

Pocket ID Version

version 2.2.0

Database

sqlite

OS and Environment

docker

Log Output

No response

Originally created by @PinkD on GitHub (Jan 30, 2026). ### Reproduction steps 1. Follow the installation guide https://pocket-id.org/docs/setup/installation, run with `docker-compose`, set `APP_URL=http://10.0.0.1:1411` in the `.env` 2. Visit `http://10.0.0.1:1411/setup` and do the setup. Click on the `Sign Up` button. We are redirected to `/login` page The `setup` response provided a `Set-Cookie` header with the `Secure` option included. Because the url is not `https`, the cookie is ignored. So when we visit the `/me` page without cookie, we are redirected to `/login` I modified `backend/internal/utils/cookie/add_cookie.go` , rebuilt the docker image to test, the issue was fixed. ref: #130 If disabling secure cookie won't break anything, maybe we should introduce an option to do that for local test without https? ### Expected behavior After finishing setup, we should go to `/signup/add-passkey` page. ### Actual Behavior We are on the `/login` page. ### Pocket ID Version version 2.2.0 ### Database sqlite ### OS and Environment docker ### Log Output _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
bug
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id#639
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?