- Dikirim
- 24 September 2026 pukul 00.11 UTC
- Penulis
- Kamo
- Commit
- 0eb2550
/api/login, /api/login/mfa and /api/session/select planted *** with httpOnly:false ("client- accessible for session checks") — but no browser code on login.* or kamo-internal reads it any more; kamo-internal carries the session per tab. A readable session cookie is one XSS away from a stolen session, so it is HttpOnly now. It also makes logout work as intended: the logout page deletes every cookie from script BEFORE calling /api/logout, so /api/logout never found *** to invalidate the session server-side; script can no longer delete it. Four log lines printed the first 32 hex characters of a session id (or of a login OTK) — they print lengths now.