fix: don't let other poeple look at our cookies

autogpt_platform/frontend/src/lib/supabase/middleware.ts

@@ -38,7 +38,12 @@ export async function updateSession(request: NextRequest) {
               request,
             });
             cookiesToSet.forEach(({ name, value, options }) =>
-              supabaseResponse.cookies.set(name, value, options),
+              supabaseResponse.cookies.set(name, value, {
+                ...options,
+                httpOnly: true,
+                secure: process.env.NODE_ENV === "production",
+                sameSite: "lax",
+              }),
             );
           },
         },

autogpt_platform/frontend/src/lib/supabase/server/getServerSupabase.ts

@@ -18,7 +18,12 @@ export async function getServerSupabase() {
           setAll(cookiesToSet) {
             try {
               cookiesToSet.forEach(({ name, value, options }) =>
-                cookieStore.set(name, value, options),
+                cookieStore.set(name, value, {
+                  ...options,
+                  httpOnly: true,
+                  secure: process.env.NODE_ENV === "production",
+                  sameSite: "lax",
+                }),
               );
             } catch {
               // The `setAll` method was called from a Server Component.