Files
chiyi a414385802 fix(auth): roll session cookie Max-Age on each authed request
The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.
2026-07-09 15:40:54 +08:00
..