From 6be4194f1f39354355cce29a2f8b8f9af7286fbd Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Thu, 30 Apr 2026 16:55:02 +0300
Subject: task oa: Add SECURE_COOKIES config to control session cookie Secure
 flag

- Add SecureCookies bool to internal.Config (default true)
- Update LoadConfig in internal/config.go to parse SECURE_COOKIES env var
- Update setSessionCookie and clearSessionCookie in internal/api/handlers.go to read cfg.SecureCookies
- Add tests verifying Secure=true/false and logout clears cookie accordingly
- Update AGENTS.md and PLAN.md with new option documentation
---
 PLAN.md | 1 +
 1 file changed, 1 insertion(+)

(limited to 'PLAN.md')

diff --git a/PLAN.md b/PLAN.md
index 7e9481b..86f89c9 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -403,6 +403,7 @@ CREATE INDEX idx_shares_expires ON shares(expires_at);
 | `GC_INTERVAL_MINUTES` | `30` | Garbage collector tick |
 | `SHARE_DEFAULT_EXPIRY_DAYS` | `7` | Default share link lifetime |
 | `LOG_LEVEL` | `info` | Log verbosity |
+| `SECURE_COOKIES` | `true` | Set `Secure` flag on session cookies; disable for plain-HTTP local deployments |
 
 ---
 
-- 
cgit v1.2.3