mirror of
https://github.com/hanzo-apps/cms.git
synced 2026-10-30 14:47:33 +00:00
zooqueen
9228be25e6
The session cookie is set Secure. It carries the reserved org's session, which reaches every tenant, so it travels over TLS only. `serverURL` names the host the admin and its links are built against, from SERVER_URL, so a request header cannot decide where a reset link points. It is also what cookie-authenticated writes are checked against, so the HTTP proof sends its requests from that host — without it a rejected origin reads as a denied permission. CMS_SECRET signs every session cookie, and production now stops rather than falling back to a value published in this file. Scheduled publish enqueues with `overrideAccess: false`, so the job it names answers to the jobs rule as its delete already does.