Add secure_cookie field to EntryConfig API response

- Add SecureCookie field to EntryConfig struct for frontend access
- Add GetCookieName helper to response package for dynamic cookie names
- Update guard.go to use GetCookieName instead of hardcoded __Host- prefix
- Pass secure_cookie setting to /user/entry API response

Co-authored-by: Cursor <cursoragent@cursor.com>

openapi/oauth/guard.go

@@ -109,7 +109,8 @@ func (s *Service) tryAutoRefreshToken(c *gin.Context, _ *types.TokenClaims) {
 func (s *Service) getAccessToken(c *gin.Context) string {
 	token := c.GetHeader("Authorization")
 	if token == "" {
-		cookie, err := c.Cookie("__Host-access_token")
+		cookieName := response.GetCookieName("access_token")
+		cookie, err := c.Cookie(cookieName)
 		if err != nil {
 			return ""
 		}
@@ -176,7 +177,8 @@ func (s *Service) GetAccessToken(c *gin.Context) string {
 func (s *Service) getRefreshToken(c *gin.Context) string {
 	token := c.GetHeader("Authorization")
 	if token == "" {
-		cookie, err := c.Cookie("__Host-refresh_token")
+		cookieName := response.GetCookieName("refresh_token")
+		cookie, err := c.Cookie(cookieName)
 		if err != nil {
 			return ""
 		}
@@ -200,7 +202,8 @@ func (s *Service) getSessionID(c *gin.Context) string {
 	}
 
 	// 1. Try to get Session ID from cookies first
-	if sid, err := c.Cookie("__Host-session_id"); err == nil && sid != "" {
+	cookieName := response.GetCookieName("session_id")
+	if sid, err := c.Cookie(cookieName); err == nil && sid != "" {
 		return sid
 	}
 

openapi/response/response.go

@@ -25,6 +25,15 @@ func IsSecureCookieEnabled() bool {
 	return secureCookieEnabled == nil || *secureCookieEnabled
 }
 
+// GetCookieName returns the correct cookie name based on secure cookie setting
+// If secure cookie is enabled, it returns "__Host-" + name, otherwise just name
+func GetCookieName(name string) string {
+	if IsSecureCookieEnabled() {
+		return "__Host-" + name
+	}
+	return name
+}
+
 // Type aliases for OAuth types to simplify usage
 type (
 	// Core response types

openapi/user/entry.go

@@ -45,6 +45,9 @@ func getEntryConfig(c *gin.Context) {
 	// Create public config without sensitive data (deep copy to avoid modifying global config)
 	publicConfig := createPublicEntryConfig(config)
 
+	// Add secure_cookie setting from OAuth config
+	publicConfig.SecureCookie = response.IsSecureCookieEnabled()
+
 	// Return the entry configuration
 	response.RespondWithSuccess(c, response.StatusOK, publicConfig)
 }

openapi/user/types.go

@@ -112,6 +112,7 @@ type EntryConfig struct {
 	InviteRequired bool              `json:"invite_required,omitempty"` // From register config
 	Invite         *InvitePageConfig `json:"invite,omitempty"`          // Invite code page configuration
 	ThirdParty     *ThirdParty       `json:"third_party,omitempty"`
+	SecureCookie   bool              `json:"secure_cookie"` // Whether secure cookie is enabled (for frontend JWT verification)
 }
 
 // MessengerConfig represents the messenger configuration for user registration