Review how my app stores and sends session tokens. Look at the cookie configuration on the server and any client-side code that reads or stores tokens (check localStorage and sessionStorage usage). Apply these requirements: session cookies must be set with HttpOnly (so JavaScript can't read them), Secure (so they only travel over HTTPS), and SameSite=Lax or Strict (so other sites can't send them). Set a reasonable max age. If session tokens are currently stored in localStorage and attached to requests manually, explain the XSS risk that creates and move them into an HttpOnly cookie instead. Do not change how long users stay logged in beyond setting a sane default. Do not break login persistence or the logout flow. If the app needs to work over plain HTTP in local development, show me how to keep that working without weakening production settings (environment-based config). Show me the before and after for every change. End with verification steps: how to inspect the cookie in browser dev tools and confirm each flag is present, and how to confirm a session token no longer appears in localStorage.