neural-hunt/V4.2.3_SESSION_UI_FIX.md

V4.2.3 – Customer session/UI diagnostics

This maintenance release fixes two confusing customer-portal behaviours:

• A failure of a downstream API such as /api/tasks no longer makes the UI look logged out. /api/me is now the authority for the customer session; other portal sections load independently and display a concrete availability error.
• Customer session cookies now carry both Max-Age and Expires. The public customer cookie uses SameSite=Lax so external payment-provider return navigations remain compatible while cross-site POST/fetch cookie use stays blocked. The private Customer Admin cookie remains SameSite=Strict.
• Hosted-code pairing failures are written to the Customer Service log with the customer id and concrete internal error.
• The bundled customer UI declares an empty favicon so /favicon.ico no longer produces distracting 404 console noise.

For HTTPS production deployments set:

CS_COOKIE_SECURE=true

If F5 still shows the login after this release, inspect GET /api/me in DevTools. A 401 there means the session cookie/database really is invalid; a 200 means the session is valid and any remaining portal problem is a downstream API error, which V4.2.3 now shows explicitly instead of replacing the portal with the login view.