update settings

agent_manager/__init__.py

@@ -159,8 +159,8 @@ def get_or_create_agent(cookie_session, chat_session):
 	# Normalize to string to avoid type-mismatch keys
 	session_key = str(cookie_session) if cookie_session else None
 
-	if not session_key or int(chat_session) == 0:
-		if session_key in SESSION_AGENTS:
+	if not session_key or chat_session == 0:
+		if session_key and session_key in SESSION_AGENTS:
 			del SESSION_AGENTS[session_key]
 			cache.delete(f"chat_session_{session_key}")
 		session_key = str(uuid.uuid4())

api/views.py

@@ -19,7 +19,7 @@ def chat(request):
 	"""Start or continue an existing chat session."""
 	# Prefer secure HttpOnly cookie for session tracking
 	cookie_session = request.COOKIES.get("gm_session")
-	chat_session = request.data.get("chat_session")
+	chat_session = request.data.get("chatSession", 0)
 	message = request.data.get("message")
 
 	if not message:

backend/settings.py

@@ -44,12 +44,12 @@ CORS_ALLOW_ALL_ORIGINS = False if MODE == 'production' else True
 
 
 SESSION_COOKIE_HTTPONLY = True
-SESSION_COOKIE_SECURE = False if MODE == 'production' else True # use False only for local dev (no HTTPS)
+SESSION_COOKIE_SECURE = True if MODE == 'production' else False # secure cookies only over HTTPS in production
 SESSION_EXPIRE_AT_BROWSER_CLOSE = True
 SESSION_COOKIE_AGE = 60 * 60 * 24  # 1 day
 
 CSRF_COOKIE_HTTPONLY = True
-CSRF_COOKIE_SECURE = False if MODE == 'production' else True
+CSRF_COOKIE_SECURE = True if MODE == 'production' else False
 CSRF_TRUSTED_ORIGINS = [
     origin.strip()
     for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
@@ -60,9 +60,9 @@ CSRF_TRUSTED_ORIGINS = [
 	'http://localhost:3000'
 	]
 
-SECURE_SSL_REDIRECT = False if MODE == 'production' else True
+SECURE_SSL_REDIRECT = True if MODE == 'production' else False
 
-SECURE_CONTENT_TYPE_NOSNIFF = False if MODE == 'production' else True
+SECURE_CONTENT_TYPE_NOSNIFF = True if MODE == 'production' else False
 
 # HSTS settings - only enable in production with proper HTTPS configuration
 # WARNING: Once enabled, browsers will remember this for SECURE_HSTS_SECONDS seconds