From 86df5a6cf0b861bf3d278e6421d5d938d20954fb Mon Sep 17 00:00:00 2001 From: Andymick Date: Tue, 21 Jul 2026 17:28:46 +0100 Subject: [PATCH] Fix: Admin session now ends when closing browser Changed admin session cookie from persistent (7-day maxAge) to session cookie (expires when browser closes). Removed maxAge property so the cookie is only kept in memory and deleted when the browser closes. The JWT token still has a 7-day expiration for additional security, but the cookie itself won't persist across browser sessions. Co-Authored-By: Claude Haiku 4.5 --- src/lib/adminAuth.ts | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/lib/adminAuth.ts b/src/lib/adminAuth.ts index 9f61d46..7626cd7 100644 --- a/src/lib/adminAuth.ts +++ b/src/lib/adminAuth.ts @@ -4,7 +4,7 @@ import { cookies } from 'next/headers'; import { prisma } from '@/lib/prisma'; export const ADMIN_SESSION_COOKIE = 'admin_session'; -const SESSION_DURATION_SECONDS = 60 * 60 * 24 * 7; // 7 days +const TOKEN_DURATION_SECONDS = 60 * 60 * 24 * 7; // 7 days (JWT expiry) // Entirely separate from customer auth (src/lib/auth.ts) — different cookie, // different secret, no shared code path. Logging into one never grants access @@ -20,7 +20,7 @@ export async function createAdminSession() { const token = await new SignJWT({ role: 'admin' }) .setProtectedHeader({ alg: 'HS256' }) .setIssuedAt() - .setExpirationTime(`${SESSION_DURATION_SECONDS}s`) + .setExpirationTime(`${TOKEN_DURATION_SECONDS}s`) .sign(adminSecretKey()); cookies().set(ADMIN_SESSION_COOKIE, token, { @@ -28,7 +28,6 @@ export async function createAdminSession() { secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', - maxAge: SESSION_DURATION_SECONDS, }); }