# V4.2.3 – Customer session/UI diagnostics

This maintenance release fixes two confusing customer-portal behaviours:

- A failure of a downstream API such as `/api/tasks` no longer makes the UI look logged out. `/api/me` is now the authority for the customer session; other portal sections load independently and display a concrete availability error.
- Customer session cookies now carry both `Max-Age` and `Expires`. The public customer cookie uses `SameSite=Lax` so external payment-provider return navigations remain compatible while cross-site POST/fetch cookie use stays blocked. The private Customer Admin cookie remains `SameSite=Strict`.
- Hosted-code pairing failures are written to the Customer Service log with the customer id and concrete internal error.
- The bundled customer UI declares an empty favicon so `/favicon.ico` no longer produces distracting 404 console noise.

For HTTPS production deployments set:

```env
CS_COOKIE_SECURE=true
```

If F5 still shows the login after this release, inspect `GET /api/me` in DevTools. A 401 there means the session cookie/database really is invalid; a 200 means the session is valid and any remaining portal problem is a downstream API error, which V4.2.3 now shows explicitly instead of replacing the portal with the login view.