package org.raddatz.familienarchiv.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;

@Configuration
public class SpringSessionConfig {

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setCookieName("fa_session");
        serializer.setSameSite("Strict");
        // cookieHttpOnly: true is the DefaultCookieSerializer default
        // useSecureCookie not set: auto-detects from request.isSecure().
        // With forward-headers-strategy: native, Caddy's X-Forwarded-Proto: https
        // causes isSecure() → true in production; direct HTTP in dev/tests → false.
        return serializer;
    }
}
