From 58aabb9bf047e14430a60473f4e4fda9fbc7d370 Mon Sep 17 00:00:00 2001
From: Victor_Jay <ovoex.cn@gmail.com>
Date: Wed, 3 Jun 2026 01:07:47 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=B4=E6=97=B6=E7=99=BB=E5=BD=95cook?=
 =?UTF-8?q?ie=E6=94=B9=E7=94=A8maxAge=3DIdleTimeout=E6=9B=BF=E4=BB=A3sessi?=
 =?UTF-8?q?on=E6=A8=A1=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- rememberMe=false时maxAge从0改为IdleTimeout秒数（默认2h），与Redis TTL一致
- 解决服务器重启后部分浏览器（尤其隐私窗口）将session cookie视为失效的问题
- 关浏览器后依然自动清除（maxAge到期 + Redis TTL双保险）
---
 internal/common/cookie.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/internal/common/cookie.go b/internal/common/cookie.go
index 94c235b..bab12c8 100644
--- a/internal/common/cookie.go
+++ b/internal/common/cookie.go
@@ -15,8 +15,8 @@ const (
 )
 
 // SetSessionCookie 写入会话 ID Cookie
-// rememberMe=true → Cookie 持久化（30天），关浏览器后仍保持登录
-// rememberMe=false → Cookie session 模式（maxAge=0），关浏览器即清除
+// rememberMe=true → Cookie maxAge=30天，关浏览器后仍保持登录
+// rememberMe=false → Cookie maxAge=空闲超时（默认2h），与Redis TTL一致，关浏览器后自动清除
 func SetSessionCookie(c *gin.Context, sid string, rememberMe bool, cfg *config.Config) {
 	secure := cfg.Server.Mode != "debug"
 	c.SetSameSite(http.SameSiteLaxMode)
@@ -25,7 +25,7 @@ func SetSessionCookie(c *gin.Context, sid string, rememberMe bool, cfg *config.C
 	if rememberMe {
 		maxAge = cfg.Session.RememberTimeout * 60 // 分钟 → 秒
 	} else {
-		maxAge = 0 // session cookie
+		maxAge = cfg.Session.IdleTimeout * 60 // 分钟 → 秒，与 Redis TTL 一致
 	}
 
 	log.Printf("[SetSessionCookie] sid=%s rememberMe=%v maxAge=%ds secure=%v", sid[:16]+"...", rememberMe, maxAge, secure)