mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
The session time-zone test stored sessions under readable secrets that the cookie shape check now refuses before the query, so it tested the refusal instead of the expiry. A shared helper mints hls_ plus 32 hex bytes, and the two route tests that set a session cookie use it too.