fix(auth): derive cookie Secure flag from request scheme

Previously session and CSRF cookies always had Secure=True, causing
browsers to reject them on plain-HTTP connections (e.g. VPN access
without TLS termination). Now secure= follows request.url.scheme so
cookies work on HTTP while remaining Secure on HTTPS.

When behind a TLS-terminating proxy the scheme is rewritten to https
via X-Forwarded-Proto (trusted proxy), so Secure is preserved there.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gorecodes

backend/arbor/csrf.py

@@ -30,12 +30,12 @@ def generate_csrf_token() -> str:
     return secrets.token_urlsafe(_TOKEN_BYTES)
 
 
-def set_csrf_cookie(response: Response, token: str) -> None:
+def set_csrf_cookie(response: Response, token: str, *, secure: bool = True) -> None:
     response.set_cookie(
         key=CSRF_COOKIE_NAME,
         value=token,
         httponly=False,
-        secure=True,
+        secure=secure,
         samesite="strict",
         max_age=session_ttl_seconds(),
         path="/",

backend/arbor/main.py

@@ -259,8 +259,9 @@ async def auth_login(request: Request):
             "step_up_method": session.get("step_up_method", ""),
         },
     )
-    set_session_cookie(response, session["session_id"])
-    set_csrf_cookie(response, generate_csrf_token())
+    _secure = request.url.scheme == "https"
+    set_session_cookie(response, session["session_id"], secure=_secure)
+    set_csrf_cookie(response, generate_csrf_token(), secure=_secure)
     return response
 
 

backend/arbor/session.py

@@ -276,12 +276,12 @@ def session_from_cookie_header(cookie_header: str | None) -> str:
     return morsel.value if morsel is not None else ""
 
 
-def set_session_cookie(response: Response, session_id: str) -> None:
+def set_session_cookie(response: Response, session_id: str, *, secure: bool = True) -> None:
     response.set_cookie(
         key=session_cookie_name(),
         value=session_id,
         httponly=True,
-        secure=True,
+        secure=secure,
         samesite="strict",
         max_age=session_ttl_seconds(),
         path="/",