kolaente 530973c475 fix(auth): make SameSite=None conditional on HTTPS for refresh cookie ... SameSite=None requires Secure=true per browser spec. When running over plain HTTP (local dev, e2e tests), browsers reject or downgrade the cookie, breaking session refresh. Fall back to SameSite=Lax for HTTP while keeping SameSite=None for HTTPS (needed for the Electron desktop app cross-origin scenario).		2026-03-03 10:41:19 +01:00
..
ldap	fix: use caller's session in LDAP syncUserGroups to avoid nested transactions	2026-02-25 11:03:02 +01:00
openid	fix: eliminate nested database sessions to prevent table locks	2026-02-25 11:03:02 +01:00
auth.go	fix(auth): make SameSite=None conditional on HTTPS for refresh cookie	2026-03-03 10:41:19 +01:00