From 5273518908ece2ef35fb1f16c237da541d70aca9 Mon Sep 17 00:00:00 2001
From: emil <emil28092005@gmail.com>
Date: Fri, 15 May 2026 01:28:24 +0300
Subject: [PATCH] fix: SameSite=Lax for OAuth cookies to allow cross-site
 redirects

---
 src/pages/api/auth/login/vk.ts     | 4 ++--
 src/pages/api/auth/login/yandex.ts | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/pages/api/auth/login/vk.ts b/src/pages/api/auth/login/vk.ts
index a6f7d00..5c88279 100644
--- a/src/pages/api/auth/login/vk.ts
+++ b/src/pages/api/auth/login/vk.ts
@@ -23,8 +23,8 @@ export const GET: APIRoute = async ({ url }) => {
   const redirectUrl = `${vkOAuthConfig.authUrl}?${params.toString()}`;
 
   const cookies = [
-    `${VERIFIER_COOKIE_NAME}=${encodeURIComponent(verifier)}; HttpOnly; SameSite=Strict; Max-Age=600; Path=/`,
-    `oauth_state=${encodeURIComponent(state)}; HttpOnly; SameSite=Strict; Max-Age=600; Path=/`,
+    `${VERIFIER_COOKIE_NAME}=${encodeURIComponent(verifier)}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,
+    `oauth_state=${encodeURIComponent(state)}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,
   ];
 
   return new Response(null, {
diff --git a/src/pages/api/auth/login/yandex.ts b/src/pages/api/auth/login/yandex.ts
index 5c35908..8b7aceb 100644
--- a/src/pages/api/auth/login/yandex.ts
+++ b/src/pages/api/auth/login/yandex.ts
@@ -23,8 +23,8 @@ export const GET: APIRoute = async ({ url }) => {
   const redirectUrl = `${yandexOAuthConfig.authUrl}?${params.toString()}`;
 
   const cookies = [
-    `${VERIFIER_COOKIE_NAME}=${encodeURIComponent(verifier)}; HttpOnly; SameSite=Strict; Max-Age=600; Path=/`,
-    `oauth_state=${encodeURIComponent(state)}; HttpOnly; SameSite=Strict; Max-Age=600; Path=/`,
+    `${VERIFIER_COOKIE_NAME}=${encodeURIComponent(verifier)}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,
+    `oauth_state=${encodeURIComponent(state)}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,
   ];
 
   return new Response(null, {