Summary

Session cookie is HttpOnly + SameSite=Lax but not Secure. DESIGN.md requires Secure. On Toolforge practical risk is low (TLS at edge); still set secure=True for defense-in-depth (env-gate only for local HTTP dev).

Code

• backend/app/api/auth.py — set_cookie on OAuth callback

Acceptance criteria

• Toolforge/production cookies include Secure
• Local HTTP dev still works via config if needed