chiyi a414385802 fix(auth): roll session cookie Max-Age on each authed request ...

The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.

2026-07-09 15:40:54 +08:00

..

router.go

fix(auth): roll session cookie Max-Age on each authed request

2026-07-09 15:40:54 +08:00