From 757c74b899a5985da797114e07748481b56c3bd7 Mon Sep 17 00:00:00 2001
From: XShine555 <xshine555@gmail.com>
Date: Sun, 5 Jul 2026 23:56:35 +0200
Subject: [PATCH] refactor(frontend): restrict insecure HTTP issuer to dev /
 explicit opt-in

---
 frontend/.env.example             |  3 +++
 frontend/src/lib/server/auth.ts   | 11 +++++------
 frontend/src/lib/server/config.ts |  3 +++
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/frontend/.env.example b/frontend/.env.example
index fc2ee33..5fc0011 100644
--- a/frontend/.env.example
+++ b/frontend/.env.example
@@ -16,5 +16,8 @@ SESSION_SECRET=change-me-to-a-long-random-string
 # SESSION_REFRESH_THRESHOLD_SECONDS=30
 # AUTH_FLOW_TTL_SECONDS=600
 
+# Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
+# AUTH_ALLOW_INSECURE_HTTP=true
+
 # Backend API base URL (used from later parts)
 API_BASE_URL=http://localhost:5111
diff --git a/frontend/src/lib/server/auth.ts b/frontend/src/lib/server/auth.ts
index 551eb66..a4fc9c7 100644
--- a/frontend/src/lib/server/auth.ts
+++ b/frontend/src/lib/server/auth.ts
@@ -1,5 +1,6 @@
 import * as client from 'openid-client';
 import { EncryptJWT, jwtDecrypt } from 'jose';
+import { dev } from '$app/environment';
 import { authConfig } from '$lib/server/config';
 import type { SessionUser } from '$lib/types';
 
@@ -16,13 +17,12 @@ export interface Session extends SessionUser {
 	expiresAt: number;
 }
 
-let configPromise: Promise<client.Configuration> | null = null;
-
+let configPromise: Promise<client.Configuration>;
 export function getOidcConfig(): Promise<client.Configuration> {
 	configPromise ??= (async () => {
 		const issuer = new URL(authConfig.issuer);
-		const options =
-			issuer.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined;
+		const insecureAllowed = (dev || authConfig.allowInsecureHttp) && issuer.protocol === 'http:';
+		const options = insecureAllowed ? { execute: [client.allowInsecureRequests] } : undefined;
 
 		const secret = authConfig.clientSecret;
 		return secret
@@ -32,8 +32,7 @@ export function getOidcConfig(): Promise<client.Configuration> {
 	return configPromise;
 }
 
-let keyPromise: Promise<Uint8Array> | null = null;
-
+let keyPromise: Promise<Uint8Array>;
 function sessionKey(): Promise<Uint8Array> {
 	keyPromise ??= crypto.subtle
 		.digest('SHA-256', new TextEncoder().encode(authConfig.sessionSecret))
diff --git a/frontend/src/lib/server/config.ts b/frontend/src/lib/server/config.ts
index 3be521d..76515cb 100644
--- a/frontend/src/lib/server/config.ts
+++ b/frontend/src/lib/server/config.ts
@@ -40,5 +40,8 @@ export const authConfig = {
 	},
 	get flowTtlSeconds() {
 		return positiveInt(env.AUTH_FLOW_TTL_SECONDS, 600);
+	},
+	get allowInsecureHttp() {
+		return env.AUTH_ALLOW_INSECURE_HTTP === 'true';
 	}
 };