From de81e54ae1fbbfb26fc59cdf276db43a068a900b Mon Sep 17 00:00:00 2001
From: emil <emil28092005@gmail.com>
Date: Fri, 15 May 2026 02:14:21 +0300
Subject: [PATCH] fix(oauth): use SameSite=Lax for session cookie to survive
 cross-site redirect

---
 .../run-continuation/ses_1d89ad89affe987QEXPgCGcx4S.json   | 7 +++----
 src/pages/api/auth/callback/vk.ts                          | 6 +++---
 src/pages/api/auth/callback/yandex.ts                      | 6 +++---
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/.sisyphus/run-continuation/ses_1d89ad89affe987QEXPgCGcx4S.json b/.sisyphus/run-continuation/ses_1d89ad89affe987QEXPgCGcx4S.json
index bbdd62d..3c66818 100644
--- a/.sisyphus/run-continuation/ses_1d89ad89affe987QEXPgCGcx4S.json
+++ b/.sisyphus/run-continuation/ses_1d89ad89affe987QEXPgCGcx4S.json
@@ -1,11 +1,10 @@
 {
   "sessionID": "ses_1d89ad89affe987QEXPgCGcx4S",
-  "updatedAt": "2026-05-14T23:04:32.000Z",
+  "updatedAt": "2026-05-14T23:12:10.460Z",
   "sources": {
     "background-task": {
-      "state": "active",
-      "reason": "1 background task(s) active",
-      "updatedAt": "2026-05-14T23:04:32.000Z"
+      "state": "idle",
+      "updatedAt": "2026-05-14T23:12:10.460Z"
     }
   }
 }
\ No newline at end of file
diff --git a/src/pages/api/auth/callback/vk.ts b/src/pages/api/auth/callback/vk.ts
index ddce15c..94c5e4f 100644
--- a/src/pages/api/auth/callback/vk.ts
+++ b/src/pages/api/auth/callback/vk.ts
@@ -108,9 +108,9 @@ export const GET: APIRoute = async ({ url, request }) => {
 
   const headers = new Headers();
   headers.set('Location', '/dm/');
-  headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; SameSite=Strict; Max-Age=604800; Path=/`);
-  headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
-  headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
+  headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
+  headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
+  headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
 
   return new Response(null, {
     status: 302,
diff --git a/src/pages/api/auth/callback/yandex.ts b/src/pages/api/auth/callback/yandex.ts
index 4f6bfb3..6232f01 100644
--- a/src/pages/api/auth/callback/yandex.ts
+++ b/src/pages/api/auth/callback/yandex.ts
@@ -109,9 +109,9 @@ export const GET: APIRoute = async ({ url, request }) => {
 
   const headers = new Headers();
   headers.set('Location', '/dm/');
-  headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; SameSite=Strict; Max-Age=604800; Path=/`);
-  headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
-  headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`);
+  headers.append('Set-Cookie', `${COOKIE_NAME}=${sessionToken}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
+  headers.append('Set-Cookie', `${VERIFIER_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
+  headers.append('Set-Cookie', `oauth_state=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/`);
 
   return new Response(null, {
     status: 302,