fix(core): prefix anonymous cookie with __Secure for https://

.changeset/silver-items-tie.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": patch
+---
+
+Adds the `__Secure-` prefix to the add additional broswer security policies around this cookie.

core/auth/anonymous-session.ts

@@ -1,26 +1,34 @@
-import { cookies } from 'next/headers';
+import { cookies, headers } from 'next/headers';
 import { AnonymousUser } from 'next-auth';
 import { decode, encode } from 'next-auth/jwt';
 
 const anonymousCookieName = 'authjs.anonymous-session-token';
 
+const shouldUseSecureCookie = async () => {
+  const headersList = await headers();
+
+  return headersList.get('x-forwarded-proto') === 'https';
+};
+
 export const anonymousSignIn = async (user: Partial<AnonymousUser> = { cartId: null }) => {
   const secret = process.env.AUTH_SECRET ?? process.env.NEXTAUTH_SECRET;
+  const useSecureCookies = await shouldUseSecureCookie();
+  const cookiePrefix = useSecureCookies ? '__Secure-' : '';
 
   if (!secret) {
     throw new Error('AUTH_SECRET is not set');
   }
 
   const cookieJar = await cookies();
   const jwt = await encode({
-    salt: anonymousCookieName,
+    salt: `${cookiePrefix}${anonymousCookieName}`,
     secret,
     token: {
       user,
     },
   });
 
-  cookieJar.set(anonymousCookieName, jwt, {
+  cookieJar.set(`${cookiePrefix}${anonymousCookieName}`, jwt, {
     secure: true,
     sameSite: 'lax',
     // We set the maxAge to 7 days as a good default for anonymous sessions.
@@ -32,7 +40,9 @@ export const anonymousSignIn = async (user: Partial<AnonymousUser> = { cartId: n
 
 export const getAnonymousSession = async () => {
   const cookieJar = await cookies();
-  const jwt = cookieJar.get(anonymousCookieName);
+  const useSecureCookies = await shouldUseSecureCookie();
+  const cookiePrefix = useSecureCookies ? '__Secure-' : '';
+  const jwt = cookieJar.get(`${cookiePrefix}${anonymousCookieName}`);
 
   if (!jwt) {
     return null;
@@ -46,7 +56,7 @@ export const getAnonymousSession = async () => {
 
   const session = await decode({
     secret,
-    salt: anonymousCookieName,
+    salt: `${cookiePrefix}${anonymousCookieName}`,
     token: jwt.value,
   });
 
@@ -55,8 +65,10 @@ export const getAnonymousSession = async () => {
 
 export const clearAnonymousSession = async () => {
   const cookieJar = await cookies();
+  const useSecureCookies = await shouldUseSecureCookie();
+  const cookiePrefix = useSecureCookies ? '__Secure-' : '';
 
-  cookieJar.delete(anonymousCookieName);
+  cookieJar.delete(`${cookiePrefix}${anonymousCookieName}`);
 };
 
 export const updateAnonymousSession = async (user: AnonymousUser) => {