Session and CSRF
reallexi_session is HttpOnly, Secure in production, and SameSite=Strict. reallexi_csrf lets the same-origin console provide a matching request header; only its hash is stored server-side.
Passkey ceremonies
Short-lived HttpOnly Strict cookies bind one-use WebAuthn registration and login ceremonies and are removed when consumed or expired.
Account activation
A short-lived HttpOnly Strict cookie replaces the one-use activation URL fragment before passkey registration.