Add environment variable configuration (v1.3.1)

Implements minimal environment-based configuration for the example
application, enabling production deployments to customize session
timeouts, rate limits, and server port without code changes.

New Configuration Variables (4 total):

SESSION_TIMEOUT_DAYS:
- Session cookie lifetime in days (default: 30)
- Range: 1-365 days (warnings outside range)
- Converts to seconds for cookie MaxAge
- Example: SESSION_TIMEOUT_DAYS=7 for weekly sessions

RATE_LIMIT_AUTH:
- Auth endpoint rate limit as "requests/sec,burst"
- Default: "5,10" (5 req/s, burst 10)
- Applies to /login and /callback endpoints
- Example: RATE_LIMIT_AUTH=10,20 for higher limits

RATE_LIMIT_API:
- API endpoint rate limit as "requests/sec,burst"
- Default: "10,20" (10 req/s, burst 20)
- Applies to /post, /create-record, /delete-record, /get-record
- Example: RATE_LIMIT_API=50,100 for high traffic

SERVER_PORT:
- HTTP server port (default: 8181)
- Example: SERVER_PORT=8080 for standard HTTP

Helper Functions:
- getEnvInt() - Parse integer env vars with validation/defaults
- getRateLimitConfig() - Parse "req/sec,burst" format with validation
- validateConfig() - Range validation with warning logs

Configuration Validation:
- Invalid values: Falls back to defaults, logs clear warnings
- Unusual values: Applied but logs configuration warnings
- Format errors: Shows expected format in error message
- Validates ranges: SESSION_TIMEOUT_DAYS (1-365), rate limits (0.1-1000)

Documentation (README.md):
- Comprehensive environment variable reference
- 4 example configurations (dev, staging, production, high-traffic)
- Deployment examples (command line, Docker, Docker Compose, K8s)
- Rate limiting guidelines by scenario
- Session timeout security recommendations
- Configuration validation behavior explained

Testing:
- Default values: All env vars optional, sensible defaults
- Custom values: SESSION_TIMEOUT_DAYS=7, RATE_LIMIT_AUTH=10,20 verified
- Invalid values: Falls back to defaults (tested "abc", "invalid")
- Unusual values: Applies with warnings (tested 400 days, 5000 req/s)
- Server startup logs show all configured values

Scope Decision (Minimal):
- Only 4 most critical production configuration needs
- Excluded (kept hardcoded with good defaults):
- HTTP client timeout (30s is industry standard)
- Server read/write/idle timeouts (best practice values)
- Cookie security flags (auto-detected, should not override)
- Logging level (already auto-configured)

Files Modified:
- examples/web-demo/main.go - Added env parsing, validation (~70 lines)
- README.md - Added Environment Variables section (~185 lines)
- TODO.md - Removed Issue #18
- COMPLETED_ISSUES.md - Added Issue #18 with implementation details
- VERSION.md - Added v1.3.1 release notes

Impact:
- No Library Changes: Example application only
- 100% Backward Compatible: All env vars optional
- 12-Factor Compliant: Environment-based configuration
- Production-Ready: Per-environment tuning without code changes
- Container-Friendly: Works with Docker, K8s, orchestration

Resolves Issue #18: Environment Configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

COMPLETED_ISSUES.md

···
 
 ## COMPLETED ISSUES
 
+### 18. Environment Configuration ✅ **COMPLETED (v1.3.1)**
+**Status:** FIXED - See [VERSION.md](VERSION.md) for details
+
+**Issue:** Limited configuration options via environment variables.
+
+**Implementation:**
+- ✅ Added 4 configurable environment variables
+  - `SESSION_TIMEOUT_DAYS` - Cookie lifetime configuration (default: 30 days)
+  - `RATE_LIMIT_AUTH` - Auth endpoint rate limits (default: 5 req/s, burst 10)
+  - `RATE_LIMIT_API` - API endpoint rate limits (default: 10 req/s, burst 20)
+  - `SERVER_PORT` - HTTP server port (default: 8181)
+
+- ✅ Helper functions for environment variable parsing
+  - `getEnvInt()` - Parse integers with validation and defaults
+  - `getRateLimitConfig()` - Parse "requests/sec,burst" format
+  - `validateConfig()` - Range validation with warnings
+
+- ✅ Configuration validation features
+  - Automatic validation on startup
+  - Warning logs for unusual but valid values
+  - Graceful fallback to defaults for invalid values
+  - Clear error messages with expected format
+
+- ✅ Comprehensive documentation
+  - Environment variable reference with defaults and examples
+  - Configuration examples for dev, staging, production, high-traffic
+  - Deployment examples (Docker, Docker Compose, Kubernetes)
+  - Rate limiting guidelines by scenario
+  - Session timeout security recommendations
+
+**Scope Decision:**
+- **Minimal approach**: Only 4 most critical production configuration needs
+- **NOT included** (kept hardcoded with good defaults):
+  - HTTP client timeout (30s is industry standard)
+  - Server read/write/idle timeouts (current values are best practice)
+  - Cookie security flags (auto-detected from HTTPS, should not be overridden)
+  - Logging level (already auto-configured based on environment)
+
+**Testing:**
+- ✅ Default values work without any environment variables
+- ✅ Custom values applied correctly
+- ✅ Invalid values fall back to defaults with warnings
+- ✅ Unusual values trigger warnings but still apply
+- ✅ Server port configuration tested
+- ✅ Rate limit configuration tested (format: "req/sec,burst")
+- ✅ Session timeout calculation tested (days to seconds conversion)
+
+**Features:**
+- **12-Factor App**: Environment-based configuration
+- **Container-Friendly**: Works with Docker, K8s, orchestration
+- **Secure by Default**: All optional, sensible defaults maintained
+- **Production-Ready**: Per-environment configuration without code changes
+- **User-Friendly**: Clear validation messages, graceful degradation
+
+**Architecture:**
+- Example application only (no core library changes)
+- Zero breaking changes
+- Backward compatible (all env vars optional)
+- Follows Go conventions (strconv, validation, error handling)
+
+**Impact:**
+- **Flexibility**: Production deployments can tune rate limits and timeouts
+- **Simplicity**: Only 4 variables (minimal configuration burden)
+- **Safety**: Validation prevents misconfiguration
+- **Documentation**: Clear guidance for all deployment scenarios
+
+**Files Modified:**
+- `examples/web-demo/main.go` - Added env parsing and validation (~70 lines)
+- `README.md` - Added environment variable documentation (~185 lines)
+
+**Test Results:**
+- ✅ Defaults: Port 8181, session 30 days, auth 5/10, API 10/20
+- ✅ Custom: All values configurable and applied correctly
+- ✅ Invalid: Falls back to defaults, logs warnings
+- ✅ Unusual: Applies value, logs configuration warning
+- ✅ No regressions: Existing functionality unchanged
+
+---
+
 ### 17. Audit Trail Support ✅ **COMPLETED (v1.3.0)**
 **Status:** FIXED - See [CHANGELOG.md](CHANGELOG.md) and [VERSION.md](VERSION.md) for details
 

README.md

···
 
 ## Environment Variables
 
-The example application supports:
+The example application (`examples/web-demo`) supports configuration via environment variables for deployment flexibility.
+
+### Required
+
+- **`BASE_URL`** - Base URL for OAuth callbacks
+  - Example: `https://myapp.com` or `http://localhost:8181`
+  - Default: `http://localhost:8181`
+
+### Optional Configuration
+
+All optional environment variables have sensible defaults. Only override if you need custom values for your deployment.
+
+#### Session Management
+
+- **`SESSION_TIMEOUT_DAYS`** - Session cookie lifetime in days
+  - Default: `30`
+  - Range: 1-365 days (warnings logged outside this range)
+  - Example: `SESSION_TIMEOUT_DAYS=7` for 7-day sessions
+  - Note: Shorter timeouts improve security, longer improves convenience
+
+#### Rate Limiting
+
+- **`RATE_LIMIT_AUTH`** - Auth endpoint rate limit as `requests/sec,burst`
+  - Default: `5,10`
+  - Format: `requests_per_second,burst_size`
+  - Example: `RATE_LIMIT_AUTH=10,20` for stricter limits
+  - Applies to: `/login`, `/callback` endpoints
+  - Purpose: Prevent brute force attacks on authentication
 
-- `BASE_URL` - Base URL for OAuth client (default: `http://localhost:8181`)
+- **`RATE_LIMIT_API`** - API endpoint rate limit as `requests/sec,burst`
+  - Default: `10,20`
+  - Format: `requests_per_second,burst_size`
+  - Example: `RATE_LIMIT_API=50,100` for higher throughput
+  - Applies to: `/post`, `/create-record`, `/delete-record`, `/get-record` endpoints
+  - Purpose: Prevent API abuse while allowing normal usage
+
+#### Server Configuration
+
+- **`SERVER_PORT`** - HTTP server port
+  - Default: `8181`
+  - Example: `SERVER_PORT=8080`
+  - Useful for container orchestration or avoiding port conflicts
+
+### Example Configurations
+
+#### Development
+
+```bash
+BASE_URL=http://localhost:8181
+SESSION_TIMEOUT_DAYS=7           # Shorter for testing
+RATE_LIMIT_AUTH=10,20            # More permissive
+RATE_LIMIT_API=50,100            # Higher for local testing
+SERVER_PORT=8181
+```
+
+#### Staging
+
+```bash
+BASE_URL=https://staging.myapp.com
+SESSION_TIMEOUT_DAYS=14          # Medium timeout
+RATE_LIMIT_AUTH=5,10             # Production-like
+RATE_LIMIT_API=20,40             # Moderate limits
+SERVER_PORT=8080
+```
+
+#### Production
+
+```bash
+BASE_URL=https://myapp.com
+SESSION_TIMEOUT_DAYS=30          # Standard (default)
+RATE_LIMIT_AUTH=5,10             # Strict (default)
+RATE_LIMIT_API=10,20             # Conservative (default)
+SERVER_PORT=8080
+```
+
+#### High-Traffic Production
+
+```bash
+BASE_URL=https://myapp.com
+SESSION_TIMEOUT_DAYS=30
+RATE_LIMIT_AUTH=10,30            # More permissive for high traffic
+RATE_LIMIT_API=100,200           # Much higher throughput
+SERVER_PORT=8080
+```
+
+### Configuration Validation
+
+The application automatically validates configuration on startup:
+
+- **Invalid values**: Falls back to defaults and logs warnings
+- **Unusual values**: Logs warnings but applies the value
+- **Format errors**: Logs clear error messages with expected format
+
+**Example validation output:**
+```
+⚠️  Warning: Invalid SESSION_TIMEOUT_DAYS value 'abc', using default: 30
+⚠️  Warning: Invalid RATE_LIMIT_AUTH format '5' (expected 'req/sec,burst'), using defaults: 5,10
+⚠️  Configuration warnings:
+   - SESSION_TIMEOUT_DAYS=400 is unusual (expected 1-365)
+   - RATE_LIMIT_API requests/sec=5000.0 is unusual (expected 0.1-1000)
+```
+
+### Running with Custom Configuration
+
+**Command line:**
+```bash
+BASE_URL=https://myapp.com SESSION_TIMEOUT_DAYS=14 go run examples/web-demo/main.go
+```
+
+**Environment file:**
+```bash
+# .env
+BASE_URL=https://myapp.com
+SESSION_TIMEOUT_DAYS=14
+RATE_LIMIT_AUTH=10,20
+RATE_LIMIT_API=50,100
+SERVER_PORT=8080
+```
+
+```bash
+source .env
+go run examples/web-demo/main.go
+```
+
+**Docker:**
+```dockerfile
+ENV BASE_URL=https://myapp.com
+ENV SESSION_TIMEOUT_DAYS=30
+ENV RATE_LIMIT_AUTH=5,10
+ENV RATE_LIMIT_API=20,40
+ENV SERVER_PORT=8080
+```
+
+**Docker Compose:**
+```yaml
+services:
+  app:
+    environment:
+      - BASE_URL=https://myapp.com
+      - SESSION_TIMEOUT_DAYS=30
+      - RATE_LIMIT_AUTH=5,10
+      - RATE_LIMIT_API=20,40
+      - SERVER_PORT=8080
+```
+
+**Kubernetes:**
+```yaml
+env:
+  - name: BASE_URL
+    value: "https://myapp.com"
+  - name: SESSION_TIMEOUT_DAYS
+    value: "30"
+  - name: RATE_LIMIT_AUTH
+    value: "5,10"
+  - name: RATE_LIMIT_API
+    value: "20,40"
+  - name: SERVER_PORT
+    value: "8080"
+```
+
+### Rate Limiting Guidelines
+
+**Auth Endpoints (login/callback):**
+- **Conservative (default)**: 5 req/s, burst 10 - Prevents brute force, minimal false positives
+- **Strict**: 2 req/s, burst 5 - Maximum security, may affect legitimate retries
+- **Permissive**: 10 req/s, burst 20 - High-traffic sites with good monitoring
+
+**API Endpoints (post/create/delete/get):**
+- **Conservative (default)**: 10 req/s, burst 20 - Prevents abuse, handles normal usage
+- **Low-traffic**: 5 req/s, burst 10 - Resource-constrained environments
+- **High-traffic**: 50-100 req/s, burst 100-200 - Large user base, active usage
+
+### Session Timeout Guidelines
+
+- **7 days**: High-security environments, sensitive data
+- **14 days**: Balanced security and convenience
+- **30 days (default)**: Standard web applications
+- **60-90 days**: Low-risk applications, convenience-focused
+- **365 days**: Not recommended (configure if absolutely required)
 
 ## Contributing
 

TODO.md

···
 
 ## Low Priority / Best Practices
 
-### 18. Environment Configuration
-**File:** [examples/web-demo/main.go:14-17](examples/web-demo/main.go#L14-L17)
-
-**Issue:** Limited configuration options via environment variables.
-
-**Recommendation:**
-- Add configuration for:
-  - Session timeout
-  - Cookie security settings
-  - Rate limiting parameters
-  - Logging level
-- Consider configuration file support
-- Validate configuration on startup
+*No low priority issues remain.*
 
 ---
 

VERSION.md

···
 - **Minor version (v1.x.0)**: New features, non-breaking enhancements
 - **Patch version (v1.0.x)**: Bug fixes, documentation updates, internal improvements
 
-## Current Version: v1.3.0
+## Current Version: v1.3.1
+
+### v1.3.1 (2025-10-29)
+
+**Patch release** - Environment variable configuration for web-demo example
+
+#### Enhancements
+
+**Environment Variable Configuration:**
+- Added 4 configurable environment variables for the example application
+- `SESSION_TIMEOUT_DAYS` - Session cookie lifetime (default: 30 days)
+- `RATE_LIMIT_AUTH` - Auth endpoint rate limits (default: 5,10)
+- `RATE_LIMIT_API` - API endpoint rate limits (default: 10,20)
+- `SERVER_PORT` - HTTP server port (default: 8181)
+
+**Configuration Validation:**
+- Automatic validation on startup with warnings for unusual values
+- Graceful fallback to defaults for invalid values
+- Clear error messages with expected format guidance
+
+**Helper Functions:**
+- `getEnvInt()` - Parse integer environment variables with defaults
+- `getRateLimitConfig()` - Parse "requests/sec,burst" format
+- `validateConfig()` - Validate configuration ranges and log warnings
+
+**Documentation:**
+- Comprehensive environment variable reference in README
+- Example configurations for dev, staging, production, and high-traffic scenarios
+- Docker, Docker Compose, and Kubernetes deployment examples
+- Rate limiting and session timeout guidelines
+
+#### Files Modified
+- `examples/web-demo/main.go` - Added environment variable parsing and validation (~70 lines)
+- `README.md` - Added "Environment Variables" section (~185 lines)
+- `TODO.md` - Removed Issue #18
+- `COMPLETED_ISSUES.md` - Added Issue #18 with implementation details
+- `VERSION.md` - Added v1.3.1 release notes
+
+#### Impact
+- **No Library Changes**: Example application only (100% backward compatible)
+- **Sensible Defaults**: All variables are optional, existing deployments unaffected
+- **Production-Ready**: Enables per-environment configuration without code changes
+- **12-Factor Compliant**: Environment-based configuration for containers/orchestration
+
+#### Issue Resolution
+- Resolves Issue #18: Environment Configuration
+- Moved to COMPLETED_ISSUES.md
+
+---
 
 ### v1.3.0 (2025-10-29)
 

examples/web-demo/main.go

···
 	"log"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
+
+	"golang.org/x/time/rate"
 
 	"github.com/shindakun/bskyoauth"
 	"github.com/shindakun/bskyoauth/lexicon"
 )
 
+// getEnvInt returns an integer environment variable or default value.
+// Logs a warning if the value is set but invalid.
+func getEnvInt(key string, defaultVal int) int {
+	if val := os.Getenv(key); val != "" {
+		if parsed, err := strconv.Atoi(val); err == nil {
+			return parsed
+		}
+		log.Printf("⚠️  Warning: Invalid %s value '%s', using default: %d", key, val, defaultVal)
+	}
+	return defaultVal
+}
+
+// getRateLimitConfig parses "requests/sec,burst" format (e.g., "5,10").
+// Returns default values if parsing fails or env var is not set.
+func getRateLimitConfig(key string, defaultReqSec float64, defaultBurst int) (float64, int) {
+	if val := os.Getenv(key); val != "" {
+		parts := strings.Split(val, ",")
+		if len(parts) == 2 {
+			reqSec, err1 := strconv.ParseFloat(strings.TrimSpace(parts[0]), 64)
+			burst, err2 := strconv.Atoi(strings.TrimSpace(parts[1]))
+			if err1 == nil && err2 == nil && reqSec > 0 && burst > 0 {
+				return reqSec, burst
+			}
+		}
+		log.Printf("⚠️  Warning: Invalid %s format '%s' (expected 'req/sec,burst'), using defaults: %.0f,%d", key, val, defaultReqSec, defaultBurst)
+	}
+	return defaultReqSec, defaultBurst
+}
+
+// validateConfig checks configuration values and logs warnings for unusual settings.
+func validateConfig(sessionTimeoutDays int, authReqSec, apiReqSec float64, authBurst, apiBurst int) {
+	warnings := []string{}
+
+	if sessionTimeoutDays < 1 || sessionTimeoutDays > 365 {
+		warnings = append(warnings, fmt.Sprintf("SESSION_TIMEOUT_DAYS=%d is unusual (expected 1-365)", sessionTimeoutDays))
+	}
+
+	if authReqSec < 0.1 || authReqSec > 100 {
+		warnings = append(warnings, fmt.Sprintf("RATE_LIMIT_AUTH requests/sec=%.1f is unusual (expected 0.1-100)", authReqSec))
+	}
+
+	if apiReqSec < 0.1 || apiReqSec > 1000 {
+		warnings = append(warnings, fmt.Sprintf("RATE_LIMIT_API requests/sec=%.1f is unusual (expected 0.1-1000)", apiReqSec))
+	}
+
+	if authBurst < 1 || apiBurst < 1 {
+		warnings = append(warnings, "Rate limit burst values must be positive")
+	}
+
+	if len(warnings) > 0 {
+		log.Println("⚠️  Configuration warnings:")
+		for _, w := range warnings {
+			log.Printf("   - %s", w)
+		}
+	}
+}
+
 func main() {
+	// Load configuration from environment variables
 	baseURL := os.Getenv("BASE_URL")
 	if baseURL == "" {
 		baseURL = "http://localhost:8181"
 	}
 
+	serverPort := os.Getenv("SERVER_PORT")
+	if serverPort == "" {
+		serverPort = "8181"
+	}
+
+	sessionTimeoutDays := getEnvInt("SESSION_TIMEOUT_DAYS", 30)
+	authReqSec, authBurst := getRateLimitConfig("RATE_LIMIT_AUTH", 5, 10)
+	apiReqSec, apiBurst := getRateLimitConfig("RATE_LIMIT_API", 10, 20)
+
+	// Validate configuration and log warnings for unusual values
+	validateConfig(sessionTimeoutDays, authReqSec, apiReqSec, authBurst, apiBurst)
+
 	// Configure structured logging based on environment
 	logger := bskyoauth.NewLoggerFromEnv(baseURL)
 	bskyoauth.SetLogger(logger)
···
 	})
 
 	// Create rate limiters for different endpoint types
-	// Login/callback: 5 requests per second, burst of 10 (prevent brute force)
-	authLimiter := bskyoauth.NewRateLimiter(5, 10)
+	// Auth endpoints (login/callback): Prevent brute force attacks
+	authLimiter := bskyoauth.NewRateLimiter(rate.Limit(authReqSec), authBurst)
 	authLimiter.StartCleanup(5*time.Minute, 10*time.Minute)
 
-	// API operations: 10 requests per second, burst of 20 (normal usage)
-	apiLimiter := bskyoauth.NewRateLimiter(10, 20)
+	// API endpoints: Normal usage rate limiting
+	apiLimiter := bskyoauth.NewRateLimiter(rate.Limit(apiReqSec), apiBurst)
 	apiLimiter.StartCleanup(5*time.Minute, 10*time.Minute)
 
 	// Set up HTTP handlers with rate limiting
···
 	mux.HandleFunc("/", homeHandler(client))
 	mux.HandleFunc("/client-metadata.json", client.ClientMetadataHandler())
 	mux.HandleFunc("/login", authLimiter.Middleware(loginHandler(client)))
-	mux.HandleFunc("/callback", authLimiter.Middleware(client.CallbackHandler(callbackSuccessHandler)))
+	mux.HandleFunc("/callback", authLimiter.Middleware(client.CallbackHandler(callbackSuccessHandler(sessionTimeoutDays))))
 	mux.HandleFunc("/post", apiLimiter.Middleware(postHandler(client)))
 	mux.HandleFunc("/create-record", apiLimiter.Middleware(createRecordHandler(client)))
 	mux.HandleFunc("/delete-record", apiLimiter.Middleware(deleteRecordHandler(client)))
···
 	// Apply security headers middleware
 	handler := bskyoauth.SecurityHeadersMiddleware()(mux)
 
-	log.Println("Server starting on :8181")
+	// Display configuration
+	log.Printf("Server starting on :%s", serverPort)
 	log.Println("Base URL:", baseURL)
 	if strings.HasPrefix(baseURL, "https://") {
 		log.Println("✓ Using HTTPS - secure configuration")
···
 	}
 
 	log.Println("✓ Rate limiting enabled:")
-	log.Println("  - Auth endpoints: 5 req/s (burst: 10)")
-	log.Println("  - API endpoints: 10 req/s (burst: 20)")
+	log.Printf("  - Auth endpoints: %.0f req/s (burst: %d)", authReqSec, authBurst)
+	log.Printf("  - API endpoints: %.0f req/s (burst: %d)", apiReqSec, apiBurst)
+	log.Printf("✓ Session timeout: %d days", sessionTimeoutDays)
 	log.Println("✓ Security headers enabled (auto-detects localhost)")
 	log.Println("✓ HTTP timeouts configured:")
 	log.Println("  - Client requests: 30s total timeout")
···
 
 	// Configure HTTP server with timeouts to prevent resource exhaustion attacks
 	server := &http.Server{
-		Addr:         ":8181",
+		Addr:         ":" + serverPort,
 		Handler:      handler,
 		ReadTimeout:  15 * time.Second, // Time to read request headers and body
 		WriteTimeout: 15 * time.Second, // Time to write response
···
 	}
 }
 
-func callbackSuccessHandler(w http.ResponseWriter, r *http.Request, sessionID string) {
-	// Add request ID for correlation
-	requestID := bskyoauth.GenerateRequestID()
-	log.Printf("[%s] OAuth callback successful, session: %s", requestID, sessionID)
+func callbackSuccessHandler(sessionTimeoutDays int) func(http.ResponseWriter, *http.Request, string) {
+	return func(w http.ResponseWriter, r *http.Request, sessionID string) {
+		// Add request ID for correlation
+		requestID := bskyoauth.GenerateRequestID()
+		log.Printf("[%s] OAuth callback successful, session: %s", requestID, sessionID)
 
-	// Determine if we're running in secure mode (HTTPS)
-	baseURL := os.Getenv("BASE_URL")
-	if baseURL == "" {
-		baseURL = "http://localhost:8181"
-	}
-	isSecure := strings.HasPrefix(baseURL, "https://")
+		// Determine if we're running in secure mode (HTTPS)
+		baseURL := os.Getenv("BASE_URL")
+		if baseURL == "" {
+			baseURL = "http://localhost:8181"
+		}
+		isSecure := strings.HasPrefix(baseURL, "https://")
 
-	// Set session cookie with security enhancements
-	http.SetCookie(w, &http.Cookie{
-		Name:     "session_id",
-		Value:    sessionID,
-		Path:     "/",
-		HttpOnly: true,                 // Prevents JavaScript access
-		Secure:   isSecure,             // HTTPS only in production
-		SameSite: http.SameSiteLaxMode, // CSRF protection
-		MaxAge:   2592000,              // 30 days (configurable)
-	})
+		// Set session cookie with security enhancements
+		http.SetCookie(w, &http.Cookie{
+			Name:     "session_id",
+			Value:    sessionID,
+			Path:     "/",
+			HttpOnly: true,                       // Prevents JavaScript access
+			Secure:   isSecure,                   // HTTPS only in production
+			SameSite: http.SameSiteLaxMode,       // CSRF protection
+			MaxAge:   sessionTimeoutDays * 86400, // Convert days to seconds
+		})
 
-	http.Redirect(w, r, "/", http.StatusFound)
+		http.Redirect(w, r, "/", http.StatusFound)
+	}
 }
 
 func postHandler(client *bskyoauth.Client) http.HandlerFunc {