Safari cookie duration hotfix

[jzgom067]

I discovered an issue where, on Safari, our session cookies are limited to only having a lifetime of 7 days, despite the intended duration being 1 year for guests and accounts with "remember me" checked on login.

This happens because of Safari's ITP (Intelligent Tracking Prevention), which, to explain it simply, doesn't like that our frontend and backend are on very different servers. Thus, it limits the cookie lifetime to prevent tracking.

The solution I implemented is a bit of a band-aid fix, similar to the host-only cookie deletion. It adds logic to the Next.js middleware that extends the lifetime of all session cookies on every request to 1 year. This works because our domain maps directly to the frontend server, so cookies from there will be treated just fine. In addition, the backend validates every session cookie it accepts, so this won't cause any problems with expired sessions.

• I tried to find a solution that just forwards cookies from the backend when the server makes requests to it during rendering, but that's not possible. Next.js sends a response to the client before starting server component rendering and HTML streaming.

The long-term solution for this would be either:

• Converting all direct client-to-backend requests into server actions
• Going back to using Next.js rewrites to proxy API requests
• Reworking our production server infrastructure to something else

[coderabbitai]

Walkthrough

The frontend now documents the COOKIE_DOMAIN configuration and its alignment with the backend setting. In non-debug mode, middleware processes only authentication cookies present on the request, refreshes nonempty cookies with domain-scoped security attributes and a one-year lifetime, and deletes matching host-only cookies.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0beb82f-b088-4aa5-8dfa-be1b8a642e75

📥 Commits

Reviewing files that changed from the base of the PR and between e10fcbe and 488f290.

📒 Files selected for processing (2)

• frontend/.env.example
• frontend/src/middleware.ts