Folio
IV
· Issue 1
· Entry 12
v4.1.12
·
29 June 2026
·
published
Chronicle of Changes.
Refined1 entry
- Cleanup after the iOS sign-in investigation: removed the temporary diagnostics and restored the pre-auth cross-site protection to its strict setting. No user-facing change.
Notes from the Archivist
The iOS sign-in saga resolved at the edge: privacy iOS browsers were reaching the site over HTTP, and a Secure session cookie can't persist over HTTP — Cloudflare "Always Use HTTPS" closed it. The detour through CSRF and cookies hardened the pre-auth path on the way, and the proxy-awareness fix that finally exposed the real cause is keeping it honest.