feat: allow overriding session cookie secure flag

src/main.ts

@@ -14,6 +14,10 @@ async function bootstrap() {
   app.use(json({ limit: requestSizeLimit }));
   app.use(urlencoded({ limit: requestSizeLimit, extended: true }));
 
+  const sessionCookieSecure = process.env.SESSION_COOKIE_SECURE
+    ? process.env.SESSION_COOKIE_SECURE === 'true'
+    : process.env.NODE_ENV === 'production';
+
   app.use(
     session({
       secret: process.env.SESSION_SECRET || 'change-me',
@@ -22,7 +26,7 @@ async function bootstrap() {
       cookie: {
         httpOnly: true,
         sameSite: (process.env.SESSION_SAME_SITE as 'strict' | 'lax' | 'none') ?? 'lax',
-        secure: process.env.NODE_ENV === 'production',
+        secure: sessionCookieSecure,
         maxAge: Number(process.env.SESSION_MAX_AGE ?? 1000 * 60 * 60 * 24 * 7),
       },
     }),