From 97c3f66b3cbfd669cfd9ca45025a7b9c409f257f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Sat, 30 May 2026 16:29:05 +0300
Subject: [PATCH] =?UTF-8?q?fix:=20saveUninitialized=20true=20=E2=80=94=20C?=
 =?UTF-8?q?SRF=20=D1=82=D0=BE=D0=BA=D0=B5=D0=BD=20=D0=B2=D0=B0=D0=BB=D0=B8?=
 =?UTF-8?q?=D0=B4=D0=B5=D0=BD=20=D0=BC=D0=B5=D0=B6=D0=B4=D1=83=20GET=20?=
 =?UTF-8?q?=D0=B8=20POST=20/login?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/middleware/session.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/middleware/session.js b/src/middleware/session.js
index 870c5a0..9a359ab 100644
--- a/src/middleware/session.js
+++ b/src/middleware/session.js
@@ -31,7 +31,10 @@ function createSessionMiddleware(pool) {
     store,
     secret:            process.env.SESSION_SECRET || 'dev-session-secret-change-me',
     resave:            false,
-    saveUninitialized: false,
+    // true: сессия сохраняется даже пустой (нужно чтобы sessionID не менялся
+    // между GET /login и POST /login — иначе CSRF-токен привязанный к sessionID
+    // из GET не совпадёт с sessionID на POST и будет 403).
+    saveUninitialized: true,
     cookie: {
       httpOnly: true,
       secure:   process.env.NODE_ENV === 'production', // HTTPS only в проде