From 7ebf8c7876b9540843d2635baf55ca4061267e40 Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 8 Nov 2026 03:37:19 +0100 Subject: web: show the account number and stop reel spin on an error Also documents the __Host- cookie prefix used on HTTPS. --- docs/WEB-PLAN.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'docs/WEB-PLAN.md') diff --git a/docs/WEB-PLAN.md b/docs/WEB-PLAN.md index 895687b..80e797b 100644 --- a/docs/WEB-PLAN.md +++ b/docs/WEB-PLAN.md @@ -61,8 +61,9 @@ Gateway → browser: `roulette`, `blackjack`, `crash`). The browser renders each screen; it never computes a result. -The cookie is `zagan_session`, HttpOnly, SameSite=Strict, Secure on HTTPS. It -is set on the WebSocket handshake. It covers refresh and the grace window only; +The cookie is `__Host-zagan_session` on HTTPS (plain `zagan_session` for local +HTTP testing), HttpOnly, SameSite=Strict, Secure on HTTPS. It is set on the +WebSocket handshake. It covers refresh and the grace window only; there is no remember-me. ## Build and run -- cgit v1.2.3