fix: align admin behavior and Kratos integrations

internal/server/httpx/cookie.go

@@ -0,0 +1,27 @@
+package httpx
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func requestUsesHTTPS(request *http.Request) bool {
+	if request.TLS != nil {
+		return true
+	}
+	forwarded := strings.SplitN(request.Header.Get("X-Forwarded-Proto"), ",", 2)[0]
+	return strings.EqualFold(strings.TrimSpace(forwarded), "https")
+}
+
+// SetTokenCookie also marks cookies Secure behind TLS or a TLS-terminating
+// reverse proxy.
+func SetTokenCookie(c *gin.Context, value string, maxAge int) {
+	cookie := &http.Cookie{Name: "x-token", Value: value, Path: "/", MaxAge: maxAge, Secure: requestUsesHTTPS(c.Request), HttpOnly: true, SameSite: http.SameSiteStrictMode}
+	if maxAge < 0 {
+		cookie.Expires = time.Unix(1, 0)
+	}
+	http.SetCookie(c.Writer, cookie)
+}