BARON-SSO 로그인 스테이징>실서버 교체

server.js

@@ -21,6 +21,7 @@ const {
 const SESSION_SECRET_VALUE = SESSION_SECRET || 'itam-headless-session-secret';
 const DEFAULT_SCOPES = ['openid', 'profile', 'email'];
 const DEFAULT_ERROR_PATH = ERROR_LOCALE_PATH || '/ko/error';
+const USE_SECURE_COOKIES = Boolean(REDIRECT_URI && REDIRECT_URI.startsWith('https://'));
 
 const dbConfig = {
   host: process.env.DB_HOST,
@@ -38,6 +39,9 @@ const getDbConnectionSummary = () => ({
 });
 
 const app = express();
+if (USE_SECURE_COOKIES) {
+  app.set('trust proxy', 1);
+}
 app.use(cors());
 app.use(express.json({ limit: '50mb' }));
 app.use(session({
@@ -47,7 +51,7 @@ app.use(session({
   cookie: {
     httpOnly: true,
     sameSite: 'lax',
-    secure: false,
+    secure: USE_SECURE_COOKIES,
     maxAge: 1000 * 60 * 60 * 8
   }
 }));