ada8ffd3b9
- Use SameSite=None for HTTPS and SameSite=Lax for development - Follows same pattern as reserveSlot handler for embed compatibility - Fixes 403 errors when cancelling bookings in embedded forms Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
24 lines
906 B
TypeScript
24 lines
906 B
TypeScript
import { randomBytes } from "crypto";
|
||
import { NextResponse } from "next/server";
|
||
|
||
import { WEBAPP_URL } from "@calcom/lib/constants";
|
||
|
||
export async function GET() {
|
||
const token = randomBytes(32).toString("hex");
|
||
|
||
const res = NextResponse.json({ csrfToken: token });
|
||
|
||
// We need this cookie to be accessible from embeds where the booking flow is displayed within an iframe on a different origin.
|
||
// For third‑party iframe contexts (embeds on other sites), browsers require SameSite=None and Secure to make the cookie available.
|
||
// For local development on http://localhost we fall back to SameSite=Lax to avoid requiring https during development.
|
||
const useSecureCookies = WEBAPP_URL.startsWith("https://");
|
||
res.cookies.set("calcom.csrf_token", token, {
|
||
httpOnly: true,
|
||
secure: useSecureCookies,
|
||
sameSite: useSecureCookies ? "none" : "lax",
|
||
path: "/",
|
||
});
|
||
|
||
return res;
|
||
}
|