From 79dade7af76272c76f8afbc5b64d9be36ea90d92 Mon Sep 17 00:00:00 2001 From: Brian Krabach Date: Sat, 28 Mar 2026 21:16:16 -0700 Subject: [PATCH] style(auth): clarify ttl_seconds is signing-time passthrough in create_session_cookie --- muxplex/auth.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/muxplex/auth.py b/muxplex/auth.py index d340eca..670da62 100644 --- a/muxplex/auth.py +++ b/muxplex/auth.py @@ -78,6 +78,8 @@ def load_or_create_secret() -> str: def create_session_cookie(secret: str, ttl_seconds: int) -> str: """Create a signed, timestamped session cookie value.""" signer = TimestampSigner(secret) + # ttl_seconds is not used at signing time; the timestamp is embedded in + # the signed value and checked against ttl_seconds during verification. return signer.sign("muxplex-session").decode()