I was showing my brother how to do some agentic development, and it went great, except for one notable problem.
We were adding a Login page to a website. The auth endpoints were already written. It generated the form, and made the request to the endpoint, and logged-in…
But the HttpOnly cookie wasn’t set in the browser. So we asked LLM for help debugging.
The solution it wrote was to return the JWT as a token in the browser, then set it in a cookie on the client-side ☠️
Mitch Downey :pci:
npub1yf…w6g6v
2026-01-17 13:27:23 UTC
Author Public Key
npub1yfr5d05qj3qzz84kntze3c8accyz0unwczgm0fxuypuqdnenkwuqew6g6vSeen on
wss://relay.ditto.pubPublished at
2026-01-17 13:27:23 UTCEvent JSON
{
"id": "1d00c6963953ff6660ad5ecb3fa190cab617adbe2791d0e09634f98d9060b6a0",
"pubkey": "224746be809440211eb69ac598e0fdc60827f26ec091b7a4dc207806cf33b3b8",
"created_at": 1768656443,
"kind": 1,
"tags": [
[
"proxy",
"https://podcastindex.social/users/mitch/statuses/115910668698153534",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "I was showing my brother how to do some agentic development, and it went great, except for one notable problem.\n\nWe were adding a Login page to a website. The auth endpoints were already written. It generated the form, and made the request to the endpoint, and logged-in…\n\nBut the HttpOnly cookie wasn’t set in the browser. So we asked LLM for help debugging.\n\nThe solution it wrote was to return the JWT as a token in the browser, then set it in a cookie on the client-side ☠️",
"sig": "da4f47b17234b83025bb6145d9f805c5fa83d0d1b4bc4871385dd05edfcab7ad23dc98e9e31434218baadc1b178b942cd6207280aa11e76d44e43421571a4cc2"
}