neural-hunt/V4.2.4_VPN_ADMIN_COOKIE_FIX.md

V4.2.4 – VPN Admin Cookie Fix

The public customer portal and the private Customer-Service admin UI now have independent cookie security modes.

Recommended deployment:

# Game admin on VPN/direct HTTP; automatically Secure when placed behind HTTPS.
ADMIN_COOKIE_SECURE=auto

# Public portal remains HTTPS-only.
CS_COOKIE_SECURE=true

# Customer-Service admin on VPN/direct HTTP; automatically Secure behind HTTPS.
CS_ADMIN_COOKIE_SECURE=auto

auto detects TLS or X-Forwarded-Proto: https. A direct HTTP connection through an encrypted VPN therefore receives a non-Secure HttpOnly admin cookie, while an HTTPS reverse proxy receives a Secure cookie.

The public customer session remains independent and HTTPS-only. HSTS is emitted only on HTTPS requests.