From cdc84c75e4b71988f6c7d9eaa97f29ae8cb06a1b Mon Sep 17 00:00:00 2001
From: gnacho <hnacho@proton.me>
Date: Wed, 16 Sep 2026 19:05:48 +0200
Subject: [PATCH] httpd: give the session cookie a Max-Age matching the timeout

The session cookie carried neither Expires nor Max-Age, so browsers that
clean up session cookies aggressively (LibreWolf, for one) may drop it
while the session is still valid. Send Max-Age=session_timeout so the
declared lifetime matches the timeout already enforced by the firmware.

itoa16_html() only converted four digits, so extend it to five to print
timeouts up to 65535. That also fixes information.json, which used the
same helper and reported wrong values from 10000 s up.
---
 httpd/httpd.c     | 2 ++
 httpd/page_impl.c | 6 ++++--
 httpd/page_impl.h | 2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/httpd/httpd.c b/httpd/httpd.c
index fb9c678f..c01b0650 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -668,6 +668,8 @@ static void run_login_body(__xdata uint8_t *body)
 				      "Set-Cookie: session=");
 		for (uint8_t i = 0; i < SESSION_ID_LENGTH; i++)
 			outbuf[slen++] = session_id[i];
+		slen += strtox(outbuf + slen, "; Max-Age=");
+		itoa16_html(session_timeout);
 		slen += strtox(outbuf + slen, "; SameSite=Strict\r\n\r\n");
 	} else {
 		dbg_string("Password invalid!\n");
diff --git a/httpd/page_impl.c b/httpd/page_impl.c
index 6011f80a..6000fd26 100644
--- a/httpd/page_impl.c
+++ b/httpd/page_impl.c
@@ -100,12 +100,14 @@ void itoa_html(uint8_t v)
 	char_to_html('0' + (v % 10));
 }
 
-void itoa16_html(uint16_t v) /* sufficient for VLAN IDs (max 4094) */
+void itoa16_html(uint16_t v) /* up to five digits (65535) */
 {
 	uint8_t print_zeros = 0;
 	uint8_t d;
-	d = v / 1000;
+	d = v / 10000;
 	if (d) { char_to_html('0' + d); print_zeros = 1; }
+	d = (v / 1000) % 10;
+	if (d || print_zeros) { char_to_html('0' + d); print_zeros = 1; }
 	d = (v / 100) % 10;
 	if (d || print_zeros) { char_to_html('0' + d); print_zeros = 1; }
 	d = (v / 10) % 10;
diff --git a/httpd/page_impl.h b/httpd/page_impl.h
index cad4cd6f..22a9f259 100644
--- a/httpd/page_impl.h
+++ b/httpd/page_impl.h
@@ -5,6 +5,8 @@
 
 extern __code uint8_t * __code HTTP_RESPONCE_TXT;
 
+void itoa16_html(uint16_t v);
+
 bool send_counters(uint8_t phys_port);
 void send_status(void);
 void send_vlan(uint16_t vlan);