From 565e29c74f093dba2cd57ff84d42e658f36f268a Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 14 Feb 2026 01:13:56 +0800 Subject: [PATCH] fix(auth): avoid cookie domain on IP hosts --- app/(auth)/auth.config.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/app/(auth)/auth.config.ts b/app/(auth)/auth.config.ts index 57a473511..d3859dc2a 100644 --- a/app/(auth)/auth.config.ts +++ b/app/(auth)/auth.config.ts @@ -1,10 +1,13 @@ import type { NextAuthConfig } from "next-auth"; +import { isIP } from "node:net"; export function buildAuthConfig(authUrl?: string | null): NextAuthConfig { const resolvedAuthUrl = authUrl || process.env.AUTH_URL || ""; const isSecure = resolvedAuthUrl.startsWith("https://"); const hostName = resolvedAuthUrl ? new URL(resolvedAuthUrl).hostname : undefined; - const cookieDomain = hostName && hostName !== "localhost" ? hostName : undefined; + // Browsers may reject `Domain` cookies for IP hosts; keep them host-only in that case. + const cookieDomain = + hostName && hostName !== "localhost" && isIP(hostName) === 0 ? hostName : undefined; return { trustHost: true,