Repository: strapi/strapi
File: packages/core/admin/server/src/bootstrap.ts (TypeScript)

Code before:
    maxRefreshTokenLifespan: strapi.config.get(
      'admin.auth.sessions.maxRefreshTokenLifespan',
      legacyMaxRefreshFallback
    ),
    idleRefreshTokenLifespan: strapi.config.get(
      'admin.auth.sessions.idleRefreshTokenLifespan',
      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN
    ),
    maxSessionLifespan: strapi.config.get(
      'admin.auth.sessions.maxSessionLifespan',
      legacyMaxSessionFallback
    ),
    idleSessionLifespan: strapi.config.get(
      'admin.auth.sessions.idleSessionLifespan',
      DEFAULT_IDLE_SESSION_LIFESPAN
    ),
    algorithm: options?.algorithm,
    // Pass through all JWT options (includes privateKey, publicKey, and any other options)
    jwtOptions: options,
  });

  const isProduction = process.env.NODE_ENV === 'production';
  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');
  if (isProduction && adminCookieSecure === false) {
    // TODO
    strapi.log.warn('PLACEHOLDER WARNING: Session cookie secure');
  }

  await registerAdminConditions();
  await registerPermissionActions();
  registerModelHooks();

  const permissionService = getService('permission');
  const userService = getService('user');
  const roleService = getService('role');
  const apiTokenService = getService('api-token');
  const transferService = getService('transfer');
  const tokenService = getService('token');

  await roleService.createRolesIfNoneExist();
  await roleService.resetSuperAdminPermissions();
  await roleService.displayWarningIfNoSuperAdmin();

  await permissionService.cleanPermissionsInDatabase();

  await userService.displayWarningIfUsersDontHaveRole();

  await syncAuthSettings();
  await syncAPITokensPermissions();

  await getService('metrics').sendUpdateProjectInformation(strapi);

Review comment (security):
```suggestion
    strapi.log.warn('Server is in production mode, but admin.auth.cookie.secure has been set to false');
```
Maybe something like that?

Code after:
    maxRefreshTokenLifespan: strapi.config.get(
      'admin.auth.sessions.maxRefreshTokenLifespan',
      legacyMaxRefreshFallback
    ),
    idleRefreshTokenLifespan: strapi.config.get(
      'admin.auth.sessions.idleRefreshTokenLifespan',
      DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN
    ),
    maxSessionLifespan: strapi.config.get(
      'admin.auth.sessions.maxSessionLifespan',
      legacyMaxSessionFallback
    ),
    idleSessionLifespan: strapi.config.get(
      'admin.auth.sessions.idleSessionLifespan',
      DEFAULT_IDLE_SESSION_LIFESPAN
    ),
    algorithm: options?.algorithm,
    // Pass through all JWT options (includes privateKey, publicKey, and any other options)
    jwtOptions: options,
  });

  const isProduction = process.env.NODE_ENV === 'production';
  const adminCookieSecure = strapi.config.get('admin.auth.cookie.secure');
  if (isProduction && adminCookieSecure === false) {
    strapi.log.warn(
      'Server is in production mode, but admin.auth.cookie.secure has been set to false. This is not recommended and will allow cookies to be sent over insecure connections.'
    );
  }

  await registerAdminConditions();
  await registerPermissionActions();
  registerModelHooks();

  const permissionService = getService('permission');
  const userService = getService('user');
  const roleService = getService('role');
  const apiTokenService = getService('api-token');
  const transferService = getService('transfer');
  const tokenService = getService('token');

  await roleService.createRolesIfNoneExist();
  await roleService.resetSuperAdminPermissions();
  await roleService.displayWarningIfNoSuperAdmin();

  await permissionService.cleanPermissionsInDatabase();

  await userService.displayWarningIfUsersDontHaveRole();

  await syncAuthSettings();
  await syncAPITokensPermissions();