From 21862d7156d448d5b0bbf01ddc8cb59c4f70a08a Mon Sep 17 00:00:00 2001
From: Ioannis Dressos <96877388+idressos@users.noreply.github.com>
Date: Wed, 8 Jul 2026 12:48:57 +0300
Subject: [PATCH] Add optional Secure flag for session cookies
 (WGUI_SESSION_SECURE_COOKIE)

---
 handler/routes.go  | 2 ++
 handler/session.go | 3 +++
 main.go            | 3 +++
 router/router.go   | 1 +
 util/config.go     | 2 ++
 5 files changed, 11 insertions(+)

diff --git a/handler/routes.go b/handler/routes.go
index 20d99c4..25de790 100644
--- a/handler/routes.go
+++ b/handler/routes.go
@@ -130,6 +130,7 @@ func Login(db store.IStore) echo.HandlerFunc {
 				Path:     cookiePath,
 				MaxAge:   ageMax,
 				HttpOnly: true,
+				Secure:   util.SecureCookie,
 				SameSite: http.SameSiteLaxMode,
 			}
 
@@ -152,6 +153,7 @@ func Login(db store.IStore) echo.HandlerFunc {
 			cookie.Value = tokenUID
 			cookie.MaxAge = ageMax
 			cookie.HttpOnly = true
+			cookie.Secure = util.SecureCookie
 			cookie.SameSite = http.SameSiteLaxMode
 			c.SetCookie(cookie)
 
diff --git a/handler/session.go b/handler/session.go
index b660d9c..95f96fa 100644
--- a/handler/session.go
+++ b/handler/session.go
@@ -113,6 +113,7 @@ func doRefreshSession(c echo.Context) {
 		Path:     cookiePath,
 		MaxAge:   maxAge,
 		HttpOnly: true,
+		Secure:   util.SecureCookie,
 		SameSite: http.SameSiteLaxMode,
 	}
 	sess.Save(c.Request(), c.Response())
@@ -123,6 +124,7 @@ func doRefreshSession(c echo.Context) {
 	cookie.Value = oldCookie.Value
 	cookie.MaxAge = maxAge
 	cookie.HttpOnly = true
+	cookie.Secure = util.SecureCookie
 	cookie.SameSite = http.SameSiteLaxMode
 	c.SetCookie(cookie)
 }
@@ -244,6 +246,7 @@ func clearSession(c echo.Context) {
 	cookie.Path = cookiePath
 	cookie.MaxAge = -1
 	cookie.HttpOnly = true
+	cookie.Secure = util.SecureCookie
 	cookie.SameSite = http.SameSiteLaxMode
 	c.SetCookie(cookie)
 }
diff --git a/main.go b/main.go
index a95e78e..6494032 100644
--- a/main.go
+++ b/main.go
@@ -51,6 +51,7 @@ var (
 	flagTelegramFloodWait        = 60
 	flagSessionSecret            = util.RandomString(32)
 	flagSessionMaxDuration       = 90
+	flagSecureCookie             = false
 	flagWgConfTemplate           string
 	flagBasePath                 string
 	flagSubnetRanges             string
@@ -100,6 +101,7 @@ func init() {
 	flag.StringVar(&flagBasePath, "base-path", util.LookupEnvOrString("BASE_PATH", flagBasePath), "The base path of the URL")
 	flag.StringVar(&flagSubnetRanges, "subnet-ranges", util.LookupEnvOrString("SUBNET_RANGES", flagSubnetRanges), "IP ranges to choose from when assigning an IP for a client.")
 	flag.IntVar(&flagSessionMaxDuration, "session-max-duration", util.LookupEnvOrInt("SESSION_MAX_DURATION", flagSessionMaxDuration), "Max time in days a remembered session is refreshed and valid.")
+	flag.BoolVar(&flagSecureCookie, "secure-cookie", util.LookupEnvOrBool(util.SecureCookieEnvVar, flagSecureCookie), "Set the Secure flag on session cookies. Enable when serving over HTTPS (e.g. behind a TLS reverse proxy).")
 	flag.StringVar(&flagBrandText, "brand-text", util.LookupEnvOrString("WGUI_BRAND_TEXT", flagBrandText), "The UI brand text or name")
 	flag.StringVar(&flagAccentColor, "accent-color", util.LookupEnvOrString("WGUI_ACCENT_COLOR", flagAccentColor), "The UI accent color")
 	flag.StringVar(&flagPageTitlePrefix, "page-title-prefix", util.LookupEnvOrString("WGUI_PAGE_TITLE_PREFIX", flagPageTitlePrefix), "The prefix of the page title")
@@ -150,6 +152,7 @@ func init() {
 	util.EmailFromName = flagEmailFromName
 	util.SessionSecret = sha512.Sum512([]byte(flagSessionSecret))
 	util.SessionMaxDuration = int64(flagSessionMaxDuration) * 86_400 // Store in seconds
+	util.SecureCookie = flagSecureCookie
 	util.WgConfTemplate = flagWgConfTemplate
 	util.BasePath = util.ParseBasePath(flagBasePath)
 	util.SubnetRanges = util.ParseSubnetRanges(flagSubnetRanges)
diff --git a/router/router.go b/router/router.go
index 473903a..46c0cd5 100644
--- a/router/router.go
+++ b/router/router.go
@@ -60,6 +60,7 @@ func New(tmplDir fs.FS, extraData map[string]interface{}, secret [64]byte) *echo
 	cookieStore := sessions.NewCookieStore(secret[:32], secret[32:])
 	cookieStore.Options.Path = cookiePath
 	cookieStore.Options.HttpOnly = true
+	cookieStore.Options.Secure = util.SecureCookie
 	cookieStore.MaxAge(86400 * 7)
 
 	e.Use(session.Middleware(cookieStore))
diff --git a/util/config.go b/util/config.go
index 6d2e6ab..c27d7be 100644
--- a/util/config.go
+++ b/util/config.go
@@ -24,6 +24,7 @@ var (
 	EmailFromName      string
 	SessionSecret      [64]byte
 	SessionMaxDuration int64
+	SecureCookie       bool
 	WgConfTemplate     string
 	BasePath           string
 	SubnetRanges       map[string]([]*net.IPNet)
@@ -77,6 +78,7 @@ const (
 	LogoFilePathEnvVar                     = "WGUI_LOGO_FILE_PATH"
 	MaxmindLicenseKeyEnvVar                = "WGUI_MAXMIND_LICENSE_KEY"
 	GeoLite2DBPathEnvVar                   = "WGUI_GEOLITE_DB_PATH"
+	SecureCookieEnvVar                     = "WGUI_SESSION_SECURE_COOKIE"
 )
 
 func ParseBasePath(basePath string) string {