- Define REQUIRED_COOKIE_NAMES in login_helper.py (10 cookies from HAR)
- login_helper.py: import-time filtering + strict all-or-nothing validation
- pickup_api.py: save_session() filters to whitelist only (prevents accumulation)
- engine.py: unified strict check, all 10 cookies required
Based on portal-to-pickup-full-flow.har analysis:
- All /pickup-web/a/* APIs use exactly 9 cookies
- JSESSIONID additionally needed for portal page fetch (Referer)
- enable_HFZrs6pXKulz is portal UI only, excluded
SkyLiCoder