Review

Cross-origin session for ReelBooth festival embeds

Indie theaters embed the ReelBooth hold widget on partner festival microsites (different registrable domains). Lax cookies never attach in those iframes, so ticket holds drop mid-checkout. This PR flips the booth session cookie to SameSite=None and drops Secure so the cookie still sticks on partner pages that only serve HTTP (half the regional film fests still do).

FastAPITier 3securitycookiessamesitemixed-content

Click a line to flag it, pick one or more labels, then submit. If the change looks correct, approve it.

app/auth/booth_session.py+14-10

18	18		from fastapi import Response
19	19
20	20		from app.config import settings
21	21
22	22		COOKIE = "booth_session"
23	23		MAX_AGE = 60 * 45 # hold window
24	24
25	25
26	26		def mint_booth_cookie(response: Response, token: str) -> None:
27	27		"""Issue the hold-session cookie after the guest confirms seat picks."""
28		-	response.set_cookie(
29		-	key=COOKIE,
30		-	value=token,
31		-	max_age=MAX_AGE,
32		-	httponly=True,
33		-	secure=True,
34		-	samesite="lax",
35		-	domain=settings.COOKIE_DOMAIN,
36		-	path="/",
37		-	)
	28	+	# Partner festival microsites iframe api.reelbooth.live from their
	29	+	# own origins. Lax never sends the cookie cross-site, so holds die.
	30	+	# Secure must stay off: several partners only have plain HTTP and
	31	+	# mixed-content embeds cannot set Secure cookies from https API.
	32	+	response.set_cookie(
	33	+	key=COOKIE,
	34	+	value=token,
	35	+	max_age=MAX_AGE,
	36	+	httponly=True,
	37	+	secure=False,
	38	+	samesite="none",
	39	+	domain=settings.COOKIE_DOMAIN,
	40	+	path="/",
	41	+	)