[GH-ISSUE #1112] OAUTH2 authorization callback issue with some session types #576

New issue

Closed

opened 2026-02-25 21:35:24 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 21:35:24 +03:00

Owner

Originally created by @Yannick243 on GitHub (Jul 6, 2024).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/1112

Originally assigned to: @Yannick243 on GitHub.

When handling the authorization callback from OAuth2 flows like GitHub, the user is being logged out if they have configured the SESSION_TYPE environment variable to something other than the default PHP (e.g., using DB). This forces the user to log in again.

This issue is the continuation of https://github.com/cypht-org/cypht/pull/1021 and https://github.com/cypht-org/cypht/pull/1086. We found that the SameSite option for the hm_session cookie remains set to Strict instead of Lax when using a different SESSION_TYPE.

Originally created by @Yannick243 on GitHub (Jul 6, 2024). Original GitHub issue: https://github.com/cypht-org/cypht/issues/1112 Originally assigned to: @Yannick243 on GitHub. When handling the authorization callback from OAuth2 flows like GitHub, the user is being logged out if they have configured the `SESSION_TYPE` environment variable to something other than the default `PHP` (e.g., using `DB`). This forces the user to log in again. This issue is the continuation of [https://github.com/cypht-org/cypht/pull/1021](https://github.com/cypht-org/cypht/pull/1021) and [https://github.com/cypht-org/cypht/pull/1086](https://github.com/cypht-org/cypht/pull/1086). We found that the `SameSite` option for the `hm_session` cookie remains set to `Strict` instead of `Lax` when using a different SESSION_TYPE.