From 0cb0133cc74e0e838afc093d89ba4033588d7924 Mon Sep 17 00:00:00 2001
From: Adrian Hajdin <contact@jsmastery.pro>
Date: Tue, 17 Feb 2026 19:59:19 +0100
Subject: [PATCH] fix: change sameSite to 'none' for Safari cross-site auth

Fixes #247

Safari on iOS 17+ blocks cookies with sameSite='strict' during OAuth
redirects from external providers (Google). This causes the session
cookie to be dropped, resulting in a redirect loop back to /sign-in.

Changes:
- Update cookie sameSite from 'strict' to 'none' in signIn()
- Update cookie sameSite from 'strict' to 'none' in signUp()

The cookies already use httpOnly=true and secure=true, making
sameSite=none safe for cross-site authentication flows.
---
 lib/actions/user.actions.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/actions/user.actions.ts b/lib/actions/user.actions.ts
index 6a2abc1..afb7d9f 100644
--- a/lib/actions/user.actions.ts
+++ b/lib/actions/user.actions.ts
@@ -40,7 +40,7 @@ export const signIn = async ({ email, password }: signInProps) => {
     cookies().set("appwrite-session", session.secret, {
       path: "/",
       httpOnly: true,
-      sameSite: "strict",
+      sameSite: "none",
       secure: true,
     });
 
@@ -95,7 +95,7 @@ export const signUp = async ({ password, ...userData }: SignUpParams) => {
     cookies().set("appwrite-session", session.secret, {
       path: "/",
       httpOnly: true,
-      sameSite: "strict",
+      sameSite: "none",
       secure: true,
     });