17 lines
1.3 KiB
Markdown
17 lines
1.3 KiB
Markdown
# V4.2.3 – Customer session/UI diagnostics
|
||
|
||
This maintenance release fixes two confusing customer-portal behaviours:
|
||
|
||
- A failure of a downstream API such as `/api/tasks` no longer makes the UI look logged out. `/api/me` is now the authority for the customer session; other portal sections load independently and display a concrete availability error.
|
||
- Customer session cookies now carry both `Max-Age` and `Expires`. The public customer cookie uses `SameSite=Lax` so external payment-provider return navigations remain compatible while cross-site POST/fetch cookie use stays blocked. The private Customer Admin cookie remains `SameSite=Strict`.
|
||
- Hosted-code pairing failures are written to the Customer Service log with the customer id and concrete internal error.
|
||
- The bundled customer UI declares an empty favicon so `/favicon.ico` no longer produces distracting 404 console noise.
|
||
|
||
For HTTPS production deployments set:
|
||
|
||
```env
|
||
CS_COOKIE_SECURE=true
|
||
```
|
||
|
||
If F5 still shows the login after this release, inspect `GET /api/me` in DevTools. A 401 there means the session cookie/database really is invalid; a 200 means the session is valid and any remaining portal problem is a downstream API error, which V4.2.3 now shows explicitly instead of replacing the portal with the login view.
|