Make secure cookie configurable

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/trust/v1/resolver.go

@@ -52,6 +52,7 @@ type (
 		TokenSecret       string
 		Scope             string
 		TokenType         string
+		CookieSecure      bool
 	}
 
 	Resolver struct {
@@ -186,6 +187,7 @@ func trySessionAuth(ctx context.Context, w http.ResponseWriter, r *http.Request,
 	sessionAuthCfg := session.AuthConfig{
 		CookieName:   authCfg.CookieName,
 		CookieSecret: authCfg.CookieSecret,
+		CookieSecure: authCfg.CookieSecure,
 	}
 
 	errorHandler := session.ErrorHandler{
@@ -256,7 +258,7 @@ func clearTokenCookie(w http.ResponseWriter, trustAuthCfg TrustAuthConfig) {
 		Domain:   trustAuthCfg.CookieDomain,
 		Path:     "/",
 		MaxAge:   -1,
-		Secure:   true,
+		Secure:   trustAuthCfg.CookieSecure,
 		HttpOnly: true,
 		SameSite: http.SameSiteStrictMode,
 	})

pkg/server/api/trust/v1/trust_center_access_handler.go

@@ -110,7 +110,7 @@ func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) htt
 			Domain:   cookieDomain,
 			Path:     "/",
 			MaxAge:   int(trustAuthCfg.CookieDuration / time.Second),
-			Secure:   true,
+			Secure:   trustAuthCfg.CookieSecure,
 			HttpOnly: true,
 			SameSite: http.SameSiteStrictMode,
 		}
@@ -159,7 +159,7 @@ func trustCenterLogoutHandler(authCfg console_v1.AuthConfig, trustAuthCfg TrustA
 			Domain:   cookieDomain,
 			Path:     "/",
 			MaxAge:   -1,
-			Secure:   true,
+			Secure:   trustAuthCfg.CookieSecure,
 			HttpOnly: true,
 			SameSite: http.SameSiteStrictMode,
 		})
@@ -167,6 +167,7 @@ func trustCenterLogoutHandler(authCfg console_v1.AuthConfig, trustAuthCfg TrustA
 		session.ClearCookie(w, session.AuthConfig{
 			CookieName:   authCfg.CookieName,
 			CookieSecret: authCfg.CookieSecret,
+			CookieSecure: authCfg.CookieSecure,
 		})
 
 		httpserver.RenderJSON(w, http.StatusOK, map[string]string{