fix: storage_api.py

common/src/common/config.py

@@ -42,6 +42,17 @@ class Settings(BaseSettings):
         default=False,
         description="Enable the self-hosted UI's short-lived demo session cookie.",
     )
+    cookie_force_secure: bool = Field(
+        default=False,
+        description=(
+            "Force the ``Secure`` flag on the session cookie even when the "
+            "inbound request scheme is plain HTTP. Enable this when running "
+            "behind a TLS-terminating reverse proxy that strips or rewrites "
+            "``X-Forwarded-Proto`` — without it the cookie is written without "
+            "the Secure flag and modern browsers will refuse to send it back "
+            "over HTTPS."
+        ),
+    )
 
     # ── service identity ──────────────────────────────────────────
     service_name: str = Field(