fix(auth): secure hydration and align password forms

2026-08-11 17:05:04 +05:30
parent 743275e6fa
commit b1086d14e9
17 changed files with 77 additions and 27 deletions
@@ -452,11 +452,13 @@ body {
 `,
  "app/layouts/document.wrn": `// Global document layout. The framework renders this once around the selected
 // page layout and merges SEO metadata, styles, and scripts into <head>/<body>.
-// Request cookies, resolved theme, language, URL, and pathname are available
-// as SSR props, so document attributes do not need a client-side correction.
+// Resolved theme, language, URL, and pathname are available as safe SSR props,
+// so document attributes do not need a client-side correction. Request cookies
+// remain server-private and are never passed into document hydration.
 layout Document {
+  runtime = "server"
+
  props {
-    cookies = {}
    theme = "light"
    language = "en"
    url = ""