From 7ebf8c7876b9540843d2635baf55ca4061267e40 Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 8 Nov 2026 03:37:19 +0100 Subject: web: show the account number and stop reel spin on an error Also documents the __Host- cookie prefix used on HTTPS. --- webd/README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'webd/README.md') diff --git a/webd/README.md b/webd/README.md index ac95fdb..7765d54 100644 --- a/webd/README.md +++ b/webd/README.md @@ -94,8 +94,10 @@ location = /ws { ## Behaviour -- The WebSocket handshake sets an HttpOnly, SameSite=Strict session cookie. - There is no credential storage in the browser or gateway. +- The WebSocket handshake sets an HttpOnly, SameSite=Strict session cookie + (`__Host-zagan_session` on HTTPS, `zagan_session` for local HTTP testing; the + `__Host-` prefix stops a sibling origin from fixing a domain cookie). There is + no credential storage in the browser or gateway. - A browser close starts the grace window. Upstream stays connected, crash ticks are still applied to the core, and a reconnect with the same cookie gets the current `View`. Expiry closes upstream; the server forfeits a live -- cgit v1.2.3