From 7a5df64746e1c9a299a9ce30b810037753770ada Mon Sep 17 00:00:00 2001
From: Sense_wang <167664334+haosenwang1018@users.noreply.github.com>
Date: Thu, 11 Jun 2026 23:59:54 +0800
Subject: [PATCH] fix: allow dashboard refresh cookie on http deployments
 (#5026)

---
 .../dashboard/src/app/api/auth/refresh/route.ts  | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/server/dashboard/src/app/api/auth/refresh/route.ts b/server/dashboard/src/app/api/auth/refresh/route.ts
index cc827c41a..0de4609d7 100644
--- a/server/dashboard/src/app/api/auth/refresh/route.ts
+++ b/server/dashboard/src/app/api/auth/refresh/route.ts
@@ -4,9 +4,23 @@ import { AUTH_ENDPOINTS } from "@/utils/api-endpoints";
 import { getServerApiUrl } from "@/lib/server-api-url";
 
 const COOKIE_NAME = "mem0_refresh_token";
+
+function shouldUseSecureCookie() {
+  const dashboardUrl = process.env.DASHBOARD_URL;
+  if (!dashboardUrl) {
+    return process.env.NODE_ENV === "production";
+  }
+
+  try {
+    return new URL(dashboardUrl).protocol === "https:";
+  } catch {
+    return process.env.NODE_ENV === "production";
+  }
+}
+
 const COOKIE_OPTIONS = {
   httpOnly: true,
-  secure: process.env.NODE_ENV === "production",
+  secure: shouldUseSecureCookie(),
   sameSite: "lax" as const,
   path: "/",
   maxAge: 30 * 24 * 60 * 60, // 30 days