From d60faca11f63233d521b68cfeb174a7d60e36759 Mon Sep 17 00:00:00 2001
From: wxg0103 <727495428@qq.com>
Date: Mon, 3 Aug 2026 13:51:46 +0800
Subject: [PATCH] fix: improve cookie handling in chat and login views for
 HTTPS support

---
 apps/chat/views/chat.py   |  9 +++++----
 apps/users/views/login.py | 10 +++++-----
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/apps/chat/views/chat.py b/apps/chat/views/chat.py
index cfbef93439d..d9f8d017837 100644
--- a/apps/chat/views/chat.py
+++ b/apps/chat/views/chat.py
@@ -116,15 +116,16 @@ def post(self, request: Request):
                      "Access-Control-Allow-Methods": "POST",
                      "Access-Control-Allow-Headers": "Origin,Content-Type,Cookie,Accept,Token"}
         )
+        is_https = request.scheme == "https"
+
         response.set_cookie(
-            'mk_file_auth',
+            key="mk_file_auth",
             value=f_token,
             max_age=7 * 24 * 3600,
             path=f'{CONFIG.get_chat_path()}/{request.data.get("access_token")}',
-            domain=None,
-            secure=request.scheme == "https",
+            secure=is_https,
             httponly=True,
-            samesite="None",
+            samesite="None" if is_https else "Lax",
         )
         return response
 
diff --git a/apps/users/views/login.py b/apps/users/views/login.py
index ae600d5fc69..3c9c80b6efe 100644
--- a/apps/users/views/login.py
+++ b/apps/users/views/login.py
@@ -51,15 +51,15 @@ def post(self, request: Request):
         token, f_token = LoginSerializer().login(request.data)
         response = result.success(token)
 
+        is_https = request.scheme == "https"
         response.set_cookie(
-            "mk_file_auth",
+            key="mk_file_auth",
             value=f_token,
             max_age=7 * 24 * 3600,
-            path=f"{CONFIG.get_admin_path()}",
-            domain=None,
-            secure=request.scheme == "https",
+            path=CONFIG.get_admin_path(),
+            secure=is_https,
             httponly=True,
-            samesite="None",
+            samesite="None" if is_https else "Lax",
         )
         return response