fix: use request.protocol to check for HTTPS (#282)

fastify · Mar 21, 2024 · cb3346f · cb3346f
1 parent c474dbe
commit cb3346f
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 9 deletions.
diff --git a/plugin.js b/plugin.js
@@ -22,7 +22,7 @@ function fastifyCookieSetCookie (reply, name, value, options) {
   }
 
   if (opts.secure === 'auto') {
-    if (isConnectionSecure(reply.request)) {
+    if (reply.request.protocol === 'https') {
       opts.secure = true
     } else {
       opts.sameSite = 'lax'
@@ -187,13 +187,6 @@ function getHook (hook = 'onRequest') {
   return hooks[hook]
 }
 
-function isConnectionSecure (request) {
-  return (
-    request.raw.socket?.encrypted === true ||
-    request.headers['x-forwarded-proto'] === 'https'
-  )
-}
-
 const fastifyCookie = fp(plugin, {
   fastify: '4.x',
   name: '@fastify/cookie'

diff --git a/test/cookie.test.js b/test/cookie.test.js
@@ -854,7 +854,7 @@ test('create signed cookie manually using signCookie decorator', async (t) => {
 })
 
 test('handle secure:auto of cookieOptions', async (t) => {
-  const fastify = Fastify()
+  const fastify = Fastify({ trustProxy: true })
 
   await fastify.register(plugin)