Feat/server tests

[michaelhthomas]

Description

• Fixes #XXXX

How Has This Been Tested?

Screenshots / Logs (if applicable)

Checklist:

• I have read and followed the contribution guidelines.
• Disclosed any use of AI (see our policy)
• I have updated the documentation accordingly.
• All new and existing tests passed.
• Successful build pnpm build
• Translation keys pnpm i18n:extract
• Database migration (if required)

In general, to fix this class of issues with express-session, you should explicitly configure the cookie option to ensure that sensitive cookies are marked as secure (sent only over HTTPS) and httpOnly (inaccessible to client-side scripts). Relying on defaults (secure: 'auto') can be brittle, especially behind proxies or in nonstandard environments.

For this specific file, the best fix is to modify the session({...}) call inside createApp to include an explicit cookie configuration, e.g. cookie: { secure: true, httpOnly: true }. This makes the intent clear and ensures that, in any environment where HTTPS is available, the cookie is not sent over cleartext. Since this is test code and we are not allowed to change other parts of the project, we should avoid adding environment-dependent logic here and just configure the cookie securely. The change is localized to server/routes/auth.test.ts, lines 28–32, and does not alter any test behavior beyond tightening cookie flags on the created session cookie; Supertest-based tests that only inspect HTTP responses will continue to work.

Concretely:

• Edit the session options object in createApp to add a cookie property with secure: true and httpOnly: true.
• No new imports are needed because cookie is just a plain object property on the express-session options.
• No other files or lines need to be updated.