ahmed mohammedandClaude Opus 4.7
8b42a0931c
kb/ is its own wiki root: 34 pages across 7 categories, index.md catalog, log.md, AGENTS.md schema layer, and raw/ holding copies of README, the spec, the 13-task plan, the design master and the SDD ledger. Every page cross-references 3 to 6 others and all 107 wikilinks resolve except two [["list"]] artefacts inside JSON snippets in the copied plan. Kept separate from the repository root on purpose: its generated graph lands in kb/.ua/ instead of overwriting the code graph. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
13 lines
745 B
Markdown
13 lines
745 B
Markdown
# Session cookie rules
|
|
|
|
The session cookie holds a 32-byte random token; only its hash is stored, and the expiry is enforced in SQL.
|
|
`httpOnly` and `sameSite: lax` always.
|
|
|
|
`Secure` is set from the request, not the build: only when `X-Forwarded-Proto` reports `https`, or when
|
|
`COOKIE_SECURE=1` is set for a direct TLS deploy. The previous rule (`secure: NODE_ENV === "production"`) meant a
|
|
production build on plain `http://localhost` asked browsers for a Secure cookie. Chromium allows that on localhost;
|
|
Safari refuses to store it at all, so every page after signup looked signed-out and the wizard appeared to sign
|
|
users out. A Chromium-only suite could never observe it.
|
|
|
|
Related: [[WebKit in QA]], [[First-run gate]], [[Running locally]].
|