# Session cookie rules

The session cookie holds a 32-byte random token; only its hash is stored, and the expiry is enforced in SQL.
`httpOnly` and `sameSite: lax` always.

`Secure` is set from the request, not the build: only when `X-Forwarded-Proto` reports `https`, or when
`COOKIE_SECURE=1` is set for a direct TLS deploy. The previous rule (`secure: NODE_ENV === "production"`) meant a
production build on plain `http://localhost` asked browsers for a Secure cookie. Chromium allows that on localhost;
Safari refuses to store it at all, so every page after signup looked signed-out and the wizard appeared to sign
users out. A Chromium-only suite could never observe it.

Related: [[WebKit in QA]], [[First-run gate]], [[Running locally]].