From 3541ca454fb68a2699a98e8b663cac6aaade1011 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=B4=EC=B0=BD=ED=98=84?= <syskiller@itosm.co.kr>
Date: Sat, 3 Oct 2026 10:15:17 +0900
Subject: [PATCH] =?UTF-8?q?QA=EC=9A=A9=20=EB=B3=B4=EC=95=88=20=EC=BF=A0?=
 =?UTF-8?q?=ED=82=A4=20=EC=84=A4=EC=A0=95=EC=9D=84=20=EB=B6=84=EB=A6=AC?=
 =?UTF-8?q?=ED=95=9C=EB=8B=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

운영에서는 Secure 쿠키를 강제한다.`nHTTP로 실행하는 격리 QA에서만 환경 변수로 해제할 수 있게 했다.
---
 backend/routers/library.py | 4 +++-
 docker-compose.yml         | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/routers/library.py b/backend/routers/library.py
index 4b53ef1..01eacd9 100644
--- a/backend/routers/library.py
+++ b/backend/routers/library.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 import json
+import os
 import re
 import secrets
 from pathlib import Path
@@ -261,12 +262,13 @@ def login(payload: AuthPayload, response: Response):
 
 
 def _set_cookie(response: Response, token: str) -> None:
+    secure_cookie = os.environ.get("SESSION_COOKIE_SECURE", "1").strip().lower() not in {"0", "false", "no"}
     response.set_cookie(
         COOKIE_NAME,
         token,
         max_age=30 * 24 * 60 * 60,
         httponly=True,
-        secure=True,
+        secure=secure_cookie,
         samesite="lax",
         path="/",
     )
diff --git a/docker-compose.yml b/docker-compose.yml
index b74ec24..9fd94ec 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -31,6 +31,7 @@ services:
       - BOOTSTRAP_ADMIN_USERNAME=syskiller
       - BOOTSTRAP_ADMIN_DISPLAY_NAME=관리자
       - BOOTSTRAP_ADMIN_PASSWORD_FILE=/run/secrets/library_admin_password
+      - SESSION_COOKIE_SECURE=1
     volumes:
       # Mount audiveris.jar from host (optional - PDF import is disabled if absent)
       - ./backend/bin:/app/bin:ro