# V4.2.4 – VPN Admin Cookie Fix

The public customer portal and the private Customer-Service admin UI now have independent cookie security modes.

Recommended deployment:

```env
# Game admin on VPN/direct HTTP; automatically Secure when placed behind HTTPS.
ADMIN_COOKIE_SECURE=auto

# Public portal remains HTTPS-only.
CS_COOKIE_SECURE=true

# Customer-Service admin on VPN/direct HTTP; automatically Secure behind HTTPS.
CS_ADMIN_COOKIE_SECURE=auto
```

`auto` detects TLS or `X-Forwarded-Proto: https`. A direct HTTP connection through an encrypted VPN therefore receives a non-Secure HttpOnly admin cookie, while an HTTPS reverse proxy receives a Secure cookie.

The public customer session remains independent and HTTPS-only. HSTS is emitted only on HTTPS requests.