# retoor <retoor@molodetz.nl>
import requests
from tests.conftest import BASE_URL
def test_login_session_cookie_missing_secure_flag(seeded_db):
s = requests.Session()
r = s.post(
f"{BASE_URL}/auth/login",
data={"email": "alice@test.devplace", "password": "secret123"},
allow_redirects=False,
)
set_cookie = r.headers.get("Set-Cookie", "")
assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"