diff --git a/server/src/net.rs b/server/src/net.rs
index 3e8df851..c53ca4cc 100644
--- a/server/src/net.rs
+++ b/server/src/net.rs
@@ -56,10 +56,10 @@ impl ResponseError for MnmlHttpError {
     }
 }
 
-fn login_res(token: String, secure: bool) -> HttpResponse {
+fn login_res(token: String) -> HttpResponse {
     HttpResponse::Ok()
         .cookie(Cookie::build("x-auth-token", token)
-            .secure(secure)
+            // .secure(secure)
             .http_only(true)
             .same_site(SameSite::Strict)
             .max_age(60 * 60 * 24 * 7) // 1 week aligns with db set
@@ -73,7 +73,7 @@ fn logout_res() -> HttpResponse {
             // .secure(secure)
             .http_only(true)
             .same_site(SameSite::Strict)
-            .max_age(-1) // 1 week aligns with db set
+            .max_age(-1)
             .finish())
         .finish()
 }
@@ -85,7 +85,7 @@ fn login(state: web::Data<State>, params: web::Json::<AccountLoginParams>) -> Re
     match account_login(&params.name, &params.password, &mut tx) {
         Ok(token) => {
             tx.commit().or(Err(MnmlHttpError::ServerError))?;
-            Ok(login_res(token, state.secure))
+            Ok(login_res(token))
         },
         Err(e) => {
             info!("{:?}", e);
@@ -119,7 +119,7 @@ fn register(state: web::Data<State>, params: web::Json::<AccountCreateParams>) -
     match account_create(&params.name, &params.password, &params.code, &mut tx) {
         Ok(token) => {
             tx.commit().or(Err(MnmlHttpError::ServerError))?;
-            Ok(login_res(token, state.secure))
+            Ok(login_res(token))
         },
         Err(e) => {
             info!("{:?}", e);
@@ -141,7 +141,6 @@ fn create_pool(url: String) -> Pool<PostgresConnectionManager> {
 pub struct State {
     pub pool: PgPool,
     // pub pubsub: PubSub,
-    secure: bool,
 }
 
 pub fn start() {
@@ -170,7 +169,7 @@ pub fn start() {
     });
 
     HttpServer::new(move || App::new()
-        .data(State { pool: pool.clone(), secure: false })
+        .data(State { pool: pool.clone() })
         .wrap(middleware::Logger::default())
         .wrap(Cors::new().supports_credentials())
         .service(web::resource("/api/login").route(web::post().to(login)))