Domains, Cookies and TLS in Production

// SAME-ORIGIN  scheme + host + port identical    (CORS cares)
// SAME-SITE    the registrable domain matches         (COOKIES care)

aicancode.org  and  api.aicancode.org
//   different origins -> CORS applies
//   SAME SITE          -> a SameSite=Lax cookie IS sent

aicancode.org  and  tool-hub-api.fly.dev
//   different origins AND cross-site
//   -> a Lax cookie is NEVER sent. Auth silently fails.

// The three workable layouts:
//   1. api.aicancode.org  (a CNAME to Fly)
//      same-site, Lax works, cookies are simple. Best default.
//   2. aicancode.org/api  (proxied through Next rewrites)
//      same-ORIGIN, so no CORS either. Costs an extra hop.
//   3. a genuinely different domain
//      needs SameSite=None; Secure, plus CSRF protection, and
//      browsers increasingly restrict third-party cookies anyway.

// Layout 3 is where people end up by accident, by shipping with the
// platform-provided hostname. Set up the custom domain before
// launch, not after the first login bug.

# Same-site (api.aicancode.org)
response.set_cookie("sid", value,
    httponly=True, secure=True, samesite="lax",
    domain=".aicancode.org",      # so both the app and the API see it
    path="/", max_age=86400)

# Cross-site (a different registrable domain)
    samesite="none", secure=True   # None REQUIRES Secure
# and now you need CSRF tokens, because the cookie is sent on
# cross-site requests by design.

# The Domain trap: setting domain=".aicancode.org" shares the cookie
# with EVERY subdomain, including any you do not control — a staging
# app, a docs site, a customer subdomain. Omit Domain to scope it to
# the exact host unless sharing is the intent.

# Secure means the cookie is not sent over http at all, which is why
# it "works locally" (http is exempt for localhost) and disappears in
# production if TLS terminates somewhere unexpected.

# Behind a proxy, tell the app it is behind one, or it builds http://
# redirect URLs and sets insecure cookies:
app.add_middleware(ProxyHeadersMiddleware, trusted_hosts="*")
# (X-Forwarded-Proto / X-Forwarded-For)

# Certificates: automatic on both platforms
flyctl certs add api.aicancode.org      # then add the CNAME/A records
# Vercel provisions for the apex and www automatically.

# Pick ONE canonical host and redirect the other, or you split
# sessions, cookies, analytics and SEO across two:
#   www.aicancode.org -> aicancode.org   (301)

# Security headers, once, at the edge:
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'self'; connect-src 'self' https://api.aicancode.org
# connect-src must include the API origin, or fetch is blocked by
# your own CSP — a self-inflicted failure that looks like CORS.

# A checklist for the domain change itself, because each item has
# been a production incident somewhere:
#   [ ] API reachable on the new host over HTTPS
#   [ ] ALLOWED_ORIGINS updated on the backend
#   [ ] NEXT_PUBLIC_API_URL updated and the frontend REBUILT
#   [ ] cookie domain and SameSite reviewed
#   [ ] OAuth redirect URIs updated at every provider
#   [ ] webhook URLs updated at every provider
#   [ ] old host redirects rather than 404s