From c0ee75efe40d97d2d23961c952670427db13a6e5 Mon Sep 17 00:00:00 2001
From: Minseong Choi <me@flyemoji.moe>
Date: Tue, 29 Sep 2026 14:08:23 +0900
Subject: [PATCH] fix(panel): mark the webview acknowledgement cookie secure

---
 internal/panel/webview.go      | 1 +
 internal/panel/webview_test.go | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/internal/panel/webview.go b/internal/panel/webview.go
index b62df37..c97745a 100644
--- a/internal/panel/webview.go
+++ b/internal/panel/webview.go
@@ -75,6 +75,7 @@ func guardInAppWebView(w http.ResponseWriter, r *http.Request) bool {
 			Value:    "1",
 			Path:     "/",
 			HttpOnly: true,
+			Secure:   true,
 			SameSite: http.SameSiteLaxMode,
 			MaxAge:   3600,
 		})
diff --git a/internal/panel/webview_test.go b/internal/panel/webview_test.go
index ef8f0fc..5bf48d5 100644
--- a/internal/panel/webview_test.go
+++ b/internal/panel/webview_test.go
@@ -138,12 +138,12 @@ func TestGuardHonorsAcknowledgement(t *testing.T) {
 	}
 	var acked bool
 	for _, c := range w.Result().Cookies() {
-		if c.Name == webViewAckCookie && c.Value == "1" {
+		if c.Name == webViewAckCookie && c.Value == "1" && c.Secure {
 			acked = true
 		}
 	}
 	if !acked {
-		t.Fatalf("ua_ack did not set the ack cookie")
+		t.Fatalf("ua_ack did not set a Secure ack cookie")
 	}
 
 	// A subsequent navigation carrying the ack cookie is not interrupted.