Session Cookie 安全属性

   ['session=<值>', 'HttpOnly', 'Path=/']

  SESSION_COOKIE_SECURE=True                   → ['session=<值>', 'Secure', 'HttpOnly', 'Path=/']
  SESSION_COOKIE_HTTPONLY=False                → ['session=<值>', 'Path=/']
  SESSION_COOKIE_SAMESITE='Lax'                → ['session=<值>', 'HttpOnly', 'Path=/', 'SameSite=Lax']
  SESSION_COOKIE_SAMESITE='Strict'             → ['session=<值>', 'HttpOnly', 'Path=/', 'SameSite=Strict']
  SESSION_COOKIE_SAMESITE='None'(没配 Secure)    → ['session=<值>', 'HttpOnly', 'Path=/', 'SameSite=None']
  SESSION_COOKIE_NAME='__Host-sid' + Secure    → ['__Host-sid=<值>', 'Secure', 'HttpOnly', 'Path=/']
  SESSION_COOKIE_PATH='/app'                   → ['session=<值>', 'HttpOnly', 'Path=/app']
  SESSION_COOKIE_DOMAIN='.example.com'         → ['session=<值>', 'Domain=example.com', 'HttpOnly', 'Path=/']
  SESSION_COOKIE_PARTITIONED=True              → ['session=<值>', 'Secure', 'HttpOnly', 'Path=/', 'Partitioned']

  不设 permanent                         → ['HttpOnly', 'Path=/']
  session.permanent=True(默认 31 天)      → ['Expires=Mon, 02 Nov 2026 05:27:40 GMT', 'HttpOnly', 'Path=/']
  PERMANENT_SESSION_LIFETIME=1 小时      → ['Expires=Fri, 02 Oct 2026 06:27:40 GMT', 'HttpOnly', 'Path=/']

  非 permanent,只读请求                           → 响应里有 Set-Cookie: False
  permanent,只读请求(默认 REFRESH=True)            → 响应里有 Set-Cookie: True
  permanent,只读请求,REFRESH=False               → 响应里有 Set-Cookie: False
  不碰 session 的请求有没有 Vary: Cookie: None
  读了 session 的请求:Vary = Cookie

  session 里放 1000 字节 → Set-Cookie 长度 830 | 警告:无
  session 里放 5000 字节 → Set-Cookie 长度 3905 | 警告:无
  session 里放 7000 字节 → Set-Cookie 长度 5454 | 警告:The 'session' cookie is too large: the value was 5428 bytes but the header required 26 extra bytes. The final 
  session 里放 9000 字节 → Set-Cookie 长度 7034 | 警告:The 'session' cookie is too large: the value was 7008 bytes but the header required 26 extra bytes. The final 

  test client 在 http 下登录后读 session → {'u': 'ann'} (test client 不检查 Secure,不能用它验证这个属性)
  SESSION_COOKIE_SECURE=False:Set-Cookie 带 Secure = False;之后 curl 经 http 带着 cookie 罐请求 /read → {"u":"ann"}
  SESSION_COOKIE_SECURE=True:Set-Cookie 带 Secure = True;之后 curl 经 http 带着 cookie 罐请求 /read → {"u":"ann"}