mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
The session time-zone test stored sessions under readable secrets that the cookie shape check now refuses before the query, so it tested the refusal instead of the expiry. A shared helper mints hls_ plus 32 hex bytes, and the two route tests that set a session cookie use it too.