From 12dcc37cbe0b6a08b78b2bfc49caea5780a46f94 Mon Sep 17 00:00:00 2001
From: Jon Seager <jon@sgrs.uk>
Date: Sun, 15 Feb 2026 10:36:05 +0000
Subject: [PATCH] fix: persist session cookie with max-age for Safari PWA
 support

Session cookie lacked a Max-Age attribute, making it ephemeral. Safari's
standalone PWA mode aggressively clears session cookies on app suspend,
causing frequent logouts. Set Max-Age to 30 days to match the server-side
session lifetime.
---
 src/application/routes/api/auth/webauthn.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/application/routes/api/auth/webauthn.rs b/src/application/routes/api/auth/webauthn.rs
index baaa6ae..f202ae0 100644
--- a/src/application/routes/api/auth/webauthn.rs
+++ b/src/application/routes/api/auth/webauthn.rs
@@ -518,6 +518,7 @@ async fn create_session(state: &AppState, cookies: &Cookies, user_id: crate::dom
     cookie.set_path("/");
     cookie.set_http_only(true);
     cookie.set_same_site(tower_cookies::cookie::SameSite::Lax);
+    cookie.set_max_age(tower_cookies::cookie::time::Duration::days(30));
 
     if !state.insecure_cookies {
         cookie.set_secure(true);