From 2fc08f40d259ae0c6af7f970c10c890e350e05fd Mon Sep 17 00:00:00 2001 From: gnacho Date: Fri, 25 Sep 2026 23:22:35 +0200 Subject: [PATCH] httpd: drop Max-Age from the session cookie The server timeout is an inactivity timeout: scan_header() refreshes last_session_use on every authenticated request. Max-Age counts from login instead, and the cookie is only set there, so the browser deletes it session_timeout seconds after logging in however busy the session is. Leave expiry to the server, which already handles it. The five-digit itoa16_html() stays: information.json must print timeouts from 10000 to 65535 correctly. --- httpd/httpd.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/httpd/httpd.c b/httpd/httpd.c index 5d9cb2cd..c4ac485a 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -690,8 +690,6 @@ static void run_login_body(__xdata uint8_t *body) "Set-Cookie: session="); for (uint8_t i = 0; i < SESSION_ID_LENGTH; i++) outbuf[slen++] = session_id[i]; - slen += strtox(outbuf + slen, "; Max-Age="); - itoa16_html(session_timeout); slen += strtox(outbuf + slen, "; SameSite=Strict\r\n\r\n"); } else { dbg_string("Password invalid!\n");