fix: cleaner cookie config management

[bosbaber]

After some misadventures in trying to figure out why login was broken on some deployments, we realised it is very hard to troubleshoot problems related to misconfigured cookies.

This PR attempts to improve the internal handling of the cookie related configuration by introducing a unit tested helper function to deal with these topics.

---

Auto generated description

This pull request improves the reliability and maintainability of authentication, CORS, and session cookie handling by centralizing host/domain logic, adding robust misconfiguration detection, and ensuring consistent configuration across HTTP and WebSocket (socket.io) interfaces. It introduces a new utility module for host-related helpers, applies these helpers throughout the backend, and adds comprehensive tests to prevent silent failures that previously caused login issues.

Centralized and Consistent Host/Domain Handling:

• Introduced a new utils/hosts.ts module with helper functions (normalizeHost, normalizeRequestHost, getFrontendOrigins, isCookieDomainUsableFrom) to consistently derive and validate browser-facing hosts and cookie domains from environment variables. This ensures that both CORS and socket.io use the same allowed origins and that cookie domains are always valid and normalized.

• Updated HTTP CORS and socket.io configuration to use getFrontendOrigins, preventing config drift and ensuring that both interfaces allow the same set of frontend origins, including the wallet subdomain. [1] [2]

Session Cookie Robustness and Misconfiguration Detection:

• Exported COOKIE_DOMAIN and added a warnOnUnusableCookieDomain middleware to detect and log when the backend issues cookies for a domain that browsers will silently reject. This middleware warns once per unique host and prevents silent login failures due to misconfiguration. [1] [2] [3]

• On server startup, logs the full browser-facing authentication configuration, making it easy to audit and debug cookie/CORS issues without reconstructing values from deployment charts.

Testing and Validation:

• Added comprehensive tests for all host utility functions, covering normalization, origin derivation, and cookie domain usability checks to catch regressions and edge cases.

Refactoring and Cleanup:

• Refactored imports in backend files to use the new helpers, ensuring all host/domain logic is centralized and consistent. [1] [2] [3]

These changes significantly reduce the risk of silent authentication failures and configuration drift between HTTP and WebSocket interfaces, while making misconfigurations much easier to detect and fix.

[Copilot]

Pull request overview

This PR improves wallet-backend browser/session configuration by centralizing frontend origin derivation and adding runtime detection/logging for misconfigured cookie domains that otherwise fail silently in browsers.

Changes:

• Introduces @/utils/hosts helper utilities (normalizeHost, getFrontendOrigins, isCookieDomainUsableFrom) and adds unit tests for them.
• Reuses getFrontendOrigins for both HTTP CORS (app.ts) and socket.io CORS (socket/service.ts) to prevent drift.
• Adds startup logging for auth-related browser config and an Express middleware to warn when the cookie Domain won’t be accepted by browsers.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/wallet/backend/tests/utils/hosts.test.ts	Adds unit coverage for new host/origin/cookie-domain helper behavior and regressions.
packages/wallet/backend/src/utils/hosts.ts	Centralizes host normalization, allowed origins, and cookie-domain usability checks.
packages/wallet/backend/src/socket/service.ts	Switches socket.io CORS origins to the shared origin derivation helper.
packages/wallet/backend/src/middleware/withSession.ts	Normalizes cookie domain, exports cookie domain, and adds middleware warning on unusable cookie domains.
packages/wallet/backend/src/app.ts	Uses shared origins for HTTP CORS, logs auth config at startup, and wires the new warning middleware.

Suppressed comments (1)

packages/wallet/backend/src/middleware/withSession.ts:22

• Despite the comment about avoiding Domain=localhost, the middleware always sets cookieOptions.domain from RAFIKI_MONEY_FRONTEND_HOST. When the env default (localhost) is used, browsers ignore Domain=localhost, which can make sessions appear to set successfully but never persist; isCookieDomainUsableFrom also won’t catch this because localhost equals the host.

let domain: string | undefined = undefined
domain = env.RAFIKI_MONEY_FRONTEND_HOST
// Fail fast if domain is not set or empty
if (!domain || domain.trim() === '') {
  console.error(

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.