Remove unnecessary cookie signing secrets

[david-crespo]

These auxiliary cookies for returnTo and inline comments have hardcoded secrets, which are pointless. Adding real secrets for them is pointless because forging the cookies can't get an attacker anything.

https://reactrouter.com/explanation/sessions-and-cookies#signing-cookies

The session cookie has a proper secret.

rfd-site/app/services/session.server.ts

Lines 32 to 42 in b30f8db

	export const sessionStorage = createCookieSessionStorage({
	cookie: {
	name: '_session',
	sameSite: 'lax', // this helps with CSRF
	path: '/', // remember to add this so the cookie will work in all routes
	httpOnly: true,
	secrets: getSecrets(),
	secure: process.env.NODE_ENV === 'production',
	maxAge: sessionMaxAge(),
	},
	})

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rfd-site	Ready	Preview	Aug 17, 2026 7:23pm

[david-crespo]

Heh, it occurs to me this will break any existing inline comments cookies, which last a year (unlike returnTo, which it would be fine to break).