secure(backend): hardcode secure=True for Google OAuth state cookie to satisfy CodeQL

Ericliu-uz · Ericliu-uz · commit 6ca28aab2d75 · 2026-07-17T15:01:42.000+10:00
diff --git a/backend-api/app/api/v1/auth.py b/backend-api/app/api/v1/auth.py
@@ -177,7 +177,7 @@ async def google_authorize() -> RedirectResponse:
         value=state,
         max_age=600,
         httponly=True,
-        secure=settings.BACKEND_PUBLIC_URL.startswith("https://"),
+        secure=True,
         samesite="lax",
         path=f"{settings.API_PREFIX}/auth/google/callback",
     )

Original file line number	Diff line number	Diff line change
`@@ -177,7 +177,7 @@ async def google_authorize() -> RedirectResponse:`
`177`	`177`	`value=state,`
`178`	`178`	`max_age=600,`
`179`	`179`	`httponly=True,`
`180`		`- secure=settings.BACKEND_PUBLIC_URL.startswith("https://"),`
	`180`	`+ secure=True,`
`181`	`181`	`samesite="lax",`
`182`	`182`	`path=f"{settings.API_PREFIX}/auth/google/callback",`
`183`	`183`	`)`