diff --git a/keyserver/src/session/cookies.js b/keyserver/src/session/cookies.js
index 87377a1a5..37368c46b 100644
--- a/keyserver/src/session/cookies.js
+++ b/keyserver/src/session/cookies.js
@@ -1,907 +1,907 @@
 // @flow
 
 import crypto from 'crypto';
 import type { $Response, $Request } from 'express';
 import invariant from 'invariant';
 import url from 'url';
 
 import type { Shape } from 'lib/types/core.js';
 import type { SignedIdentityKeysBlob } from 'lib/types/crypto-types.js';
 import { isWebPlatform } from 'lib/types/device-types.js';
 import type { Platform, PlatformDetails } from 'lib/types/device-types.js';
 import type { CalendarQuery } from 'lib/types/entry-types.js';
 import {
   type ServerSessionChange,
   cookieLifetime,
   cookieSources,
   type CookieSource,
   cookieTypes,
   sessionIdentifierTypes,
   type SessionIdentifierType,
 } from 'lib/types/session-types.js';
 import type { SIWESocialProof } from 'lib/types/siwe-types.js';
 import type { InitialClientSocketMessage } from 'lib/types/socket-types.js';
 import type { UserInfo } from 'lib/types/user-types.js';
 import { values } from 'lib/utils/objects.js';
 import { promiseAll } from 'lib/utils/promises.js';
 
 import {
   isBcryptHash,
   getCookieHash,
   verifyCookieHash,
 } from './cookie-hash.js';
 import { Viewer } from './viewer.js';
 import type { AnonymousViewerData, UserViewerData } from './viewer.js';
 import createIDs from '../creators/id-creator.js';
 import { createSession } from '../creators/session-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { deleteCookie } from '../deleters/cookie-deleters.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import { clearDeviceToken } from '../updaters/device-token-updaters.js';
 import { assertSecureRequest } from '../utils/security-utils.js';
 import {
   type AppURLFacts,
   getAppURLFactsFromRequestURL,
 } from '../utils/urls.js';
 
 function cookieIsExpired(lastUsed: number) {
   return lastUsed + cookieLifetime <= Date.now();
 }
 
 type SessionParameterInfo = {
   isSocket: boolean,
   sessionID: ?string,
   sessionIdentifierType: SessionIdentifierType,
   ipAddress: string,
   userAgent: ?string,
 };
 
 type FetchViewerResult =
   | { type: 'valid', viewer: Viewer }
   | InvalidFetchViewerResult;
 
 type InvalidFetchViewerResult =
   | {
       type: 'nonexistant',
       cookieName: ?string,
       cookieSource: ?CookieSource,
       sessionParameterInfo: SessionParameterInfo,
     }
   | {
       type: 'invalidated',
       cookieName: string,
       cookieID: string,
       cookieSource: CookieSource,
       sessionParameterInfo: SessionParameterInfo,
       platformDetails: ?PlatformDetails,
       deviceToken: ?string,
     };
 
 async function fetchUserViewer(
   cookie: string,
   cookieSource: CookieSource,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   const [cookieID, cookiePassword] = cookie.split(':');
   if (!cookieID || !cookiePassword) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.USER,
       cookieSource,
       sessionParameterInfo,
     };
   }
 
   const query = SQL`
     SELECT hash, user, last_used, platform, device_token, versions
     FROM cookies
     WHERE id = ${cookieID} AND user IS NOT NULL
   `;
   const [[result], allSessionInfo] = await Promise.all([
     dbQuery(query),
     fetchSessionInfo(sessionParameterInfo, cookieID),
   ]);
   if (result.length === 0) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.USER,
       cookieSource,
       sessionParameterInfo,
     };
   }
 
   let sessionID = null,
     sessionInfo = null;
   if (allSessionInfo) {
     ({ sessionID, ...sessionInfo } = allSessionInfo);
   }
 
   const cookieRow = result[0];
   let platformDetails = null;
   if (cookieRow.versions) {
     const versions = JSON.parse(cookieRow.versions);
     platformDetails = {
       platform: cookieRow.platform,
       codeVersion: versions.codeVersion,
       stateVersion: versions.stateVersion,
     };
   } else {
     platformDetails = { platform: cookieRow.platform };
   }
   const deviceToken = cookieRow.device_token;
   const cookieHash = cookieRow.hash;
 
   if (
     !verifyCookieHash(cookiePassword, cookieHash) ||
     cookieIsExpired(cookieRow.last_used)
   ) {
     return {
       type: 'invalidated',
       cookieName: cookieTypes.USER,
       cookieID,
       cookieSource,
       sessionParameterInfo,
       platformDetails,
       deviceToken,
     };
   }
   const userID = cookieRow.user.toString();
   const viewer = new Viewer({
     isSocket: sessionParameterInfo.isSocket,
     loggedIn: true,
     id: userID,
     platformDetails,
     deviceToken,
     userID,
     cookieSource,
     cookieID,
     cookiePassword,
     cookieHash,
     sessionIdentifierType: sessionParameterInfo.sessionIdentifierType,
     sessionID,
     sessionInfo,
     isScriptViewer: false,
     ipAddress: sessionParameterInfo.ipAddress,
     userAgent: sessionParameterInfo.userAgent,
   });
   return { type: 'valid', viewer };
 }
 
 async function fetchAnonymousViewer(
   cookie: string,
   cookieSource: CookieSource,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   const [cookieID, cookiePassword] = cookie.split(':');
   if (!cookieID || !cookiePassword) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.ANONYMOUS,
       cookieSource,
       sessionParameterInfo,
     };
   }
 
   const query = SQL`
     SELECT last_used, hash, platform, device_token, versions
     FROM cookies
     WHERE id = ${cookieID} AND user IS NULL
   `;
   const [[result], allSessionInfo] = await Promise.all([
     dbQuery(query),
     fetchSessionInfo(sessionParameterInfo, cookieID),
   ]);
   if (result.length === 0) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.ANONYMOUS,
       cookieSource,
       sessionParameterInfo,
     };
   }
 
   let sessionID = null,
     sessionInfo = null;
   if (allSessionInfo) {
     ({ sessionID, ...sessionInfo } = allSessionInfo);
   }
 
   const cookieRow = result[0];
   let platformDetails = null;
   if (cookieRow.platform && cookieRow.versions) {
     const versions = JSON.parse(cookieRow.versions);
     platformDetails = {
       platform: cookieRow.platform,
       codeVersion: versions.codeVersion,
       stateVersion: versions.stateVersion,
     };
   } else if (cookieRow.platform) {
     platformDetails = { platform: cookieRow.platform };
   }
   const deviceToken = cookieRow.device_token;
   const cookieHash = cookieRow.hash;
 
   if (
     !verifyCookieHash(cookiePassword, cookieHash) ||
     cookieIsExpired(cookieRow.last_used)
   ) {
     return {
       type: 'invalidated',
       cookieName: cookieTypes.ANONYMOUS,
       cookieID,
       cookieSource,
       sessionParameterInfo,
       platformDetails,
       deviceToken,
     };
   }
   const viewer = new Viewer({
     isSocket: sessionParameterInfo.isSocket,
     loggedIn: false,
     id: cookieID,
     platformDetails,
     deviceToken,
     cookieSource,
     cookieID,
     cookiePassword,
     cookieHash,
     sessionIdentifierType: sessionParameterInfo.sessionIdentifierType,
     sessionID,
     sessionInfo,
     isScriptViewer: false,
     ipAddress: sessionParameterInfo.ipAddress,
     userAgent: sessionParameterInfo.userAgent,
   });
   return { type: 'valid', viewer };
 }
 
 type SessionInfo = {
   +sessionID: ?string,
   +lastValidated: number,
   +lastUpdate: number,
   +calendarQuery: CalendarQuery,
 };
 async function fetchSessionInfo(
   sessionParameterInfo: SessionParameterInfo,
   cookieID: string,
 ): Promise<?SessionInfo> {
   const { sessionID } = sessionParameterInfo;
   const session = sessionID !== undefined ? sessionID : cookieID;
   if (!session) {
     return null;
   }
   const query = SQL`
     SELECT query, last_validated, last_update
     FROM sessions
     WHERE id = ${session} AND cookie = ${cookieID}
   `;
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   return {
     sessionID,
     lastValidated: result[0].last_validated,
     lastUpdate: result[0].last_update,
     calendarQuery: JSON.parse(result[0].query),
   };
 }
 
 // This function is meant to consume a cookie that has already been processed.
 // That means it doesn't have any logic to handle an invalid cookie, and it
 // doesn't update the cookie's last_used timestamp.
 async function fetchViewerFromCookieData(
   req: $Request,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   let viewerResult;
   const { user, anonymous } = req.cookies;
   if (user) {
     viewerResult = await fetchUserViewer(
       user,
       cookieSources.HEADER,
       sessionParameterInfo,
     );
   } else if (anonymous) {
     viewerResult = await fetchAnonymousViewer(
       anonymous,
       cookieSources.HEADER,
       sessionParameterInfo,
     );
   } else {
     return {
       type: 'nonexistant',
       cookieName: null,
       cookieSource: null,
       sessionParameterInfo,
     };
   }
 
   // We protect against CSRF attacks by making sure that on web,
   // non-GET requests cannot use a bare cookie for session identification
   if (viewerResult.type === 'valid') {
     const { viewer } = viewerResult;
     invariant(
       req.method === 'GET' ||
         viewer.sessionIdentifierType !== sessionIdentifierTypes.COOKIE_ID ||
         !isWebPlatform(viewer.platform),
       'non-GET request from web using sessionIdentifierTypes.COOKIE_ID',
     );
   }
 
   return viewerResult;
 }
 
 async function fetchViewerFromRequestBody(
   body: mixed,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   if (!body || typeof body !== 'object') {
     return {
       type: 'nonexistant',
       cookieName: null,
       cookieSource: null,
       sessionParameterInfo,
     };
   }
   const cookiePair = body.cookie;
   if (cookiePair === null || cookiePair === '') {
     return {
       type: 'nonexistant',
       cookieName: null,
       cookieSource: cookieSources.BODY,
       sessionParameterInfo,
     };
   }
   if (!cookiePair || typeof cookiePair !== 'string') {
     return {
       type: 'nonexistant',
       cookieName: null,
       cookieSource: null,
       sessionParameterInfo,
     };
   }
   const [type, cookie] = cookiePair.split('=');
   if (type === cookieTypes.USER && cookie) {
     return await fetchUserViewer(
       cookie,
       cookieSources.BODY,
       sessionParameterInfo,
     );
   } else if (type === cookieTypes.ANONYMOUS && cookie) {
     return await fetchAnonymousViewer(
       cookie,
       cookieSources.BODY,
       sessionParameterInfo,
     );
   }
   return {
     type: 'nonexistant',
     cookieName: null,
     cookieSource: null,
     sessionParameterInfo,
   };
 }
 
 function getRequestIPAddress(req: $Request) {
   const { proxy } = getAppURLFactsFromRequestURL(req.originalUrl);
   let ipAddress;
   if (proxy === 'none') {
     ipAddress = req.socket.remoteAddress;
   } else if (proxy === 'apache') {
     ipAddress = req.get('X-Forwarded-For');
   }
   invariant(ipAddress, 'could not determine requesting IP address');
   return ipAddress;
 }
 
 function getSessionParameterInfoFromRequestBody(
   req: $Request,
 ): SessionParameterInfo {
   const body = (req.body: any);
   let sessionID =
     body.sessionID !== undefined || req.method !== 'GET'
       ? body.sessionID
       : null;
   if (sessionID === '') {
     sessionID = null;
   }
   const sessionIdentifierType =
     req.method === 'GET' || sessionID !== undefined
       ? sessionIdentifierTypes.BODY_SESSION_ID
       : sessionIdentifierTypes.COOKIE_ID;
   return {
     isSocket: false,
     sessionID,
     sessionIdentifierType,
     ipAddress: getRequestIPAddress(req),
     userAgent: req.get('User-Agent'),
   };
 }
 
 async function fetchViewerForJSONRequest(req: $Request): Promise<Viewer> {
   assertSecureRequest(req);
   const sessionParameterInfo = getSessionParameterInfoFromRequestBody(req);
   let result = await fetchViewerFromRequestBody(req.body, sessionParameterInfo);
   if (
     result.type === 'nonexistant' &&
     (result.cookieSource === null || result.cookieSource === undefined)
   ) {
     result = await fetchViewerFromCookieData(req, sessionParameterInfo);
   }
   return await handleFetchViewerResult(result);
 }
 
 const webPlatformDetails = { platform: 'web' };
 async function fetchViewerForHomeRequest(req: $Request): Promise<Viewer> {
   assertSecureRequest(req);
   const sessionParameterInfo = getSessionParameterInfoFromRequestBody(req);
   const result = await fetchViewerFromCookieData(req, sessionParameterInfo);
   return await handleFetchViewerResult(result, webPlatformDetails);
 }
 
 async function fetchViewerForSocket(
   req: $Request,
   clientMessage: InitialClientSocketMessage,
 ): Promise<?Viewer> {
   assertSecureRequest(req);
   const { sessionIdentification } = clientMessage.payload;
   const { sessionID } = sessionIdentification;
   const sessionParameterInfo = {
     isSocket: true,
     sessionID,
     sessionIdentifierType:
       sessionID !== undefined
         ? sessionIdentifierTypes.BODY_SESSION_ID
         : sessionIdentifierTypes.COOKIE_ID,
     ipAddress: getRequestIPAddress(req),
     userAgent: req.get('User-Agent'),
   };
 
   let result = await fetchViewerFromRequestBody(
     clientMessage.payload.sessionIdentification,
     sessionParameterInfo,
   );
   if (
     result.type === 'nonexistant' &&
     (result.cookieSource === null || result.cookieSource === undefined)
   ) {
     result = await fetchViewerFromCookieData(req, sessionParameterInfo);
   }
   if (result.type === 'valid') {
     return result.viewer;
   }
 
   const promises = {};
   if (result.cookieSource === cookieSources.BODY) {
     // We initialize a socket's Viewer after the WebSocket handshake, since to
     // properly initialize the Viewer we need a bunch of data, but that data
     // can't be sent until after the handshake. Consequently, by the time we
     // know that a cookie may be invalid, we are no longer communicating via
     // HTTP, and have no way to set a new cookie for HEADER (web) clients.
     const platformDetails =
       result.type === 'invalidated' ? result.platformDetails : null;
     const deviceToken =
       result.type === 'invalidated' ? result.deviceToken : null;
     promises.anonymousViewerData = createNewAnonymousCookie({
       platformDetails,
       deviceToken,
     });
   }
   if (result.type === 'invalidated') {
     promises.deleteCookie = deleteCookie(result.cookieID);
   }
   const { anonymousViewerData } = await promiseAll(promises);
 
   if (!anonymousViewerData) {
     return null;
   }
 
   return createViewerForInvalidFetchViewerResult(result, anonymousViewerData);
 }
 
 async function handleFetchViewerResult(
   result: FetchViewerResult,
   inputPlatformDetails?: PlatformDetails,
 ) {
   if (result.type === 'valid') {
     return result.viewer;
   }
 
   let platformDetails = inputPlatformDetails;
   if (!platformDetails && result.type === 'invalidated') {
     platformDetails = result.platformDetails;
   }
   const deviceToken = result.type === 'invalidated' ? result.deviceToken : null;
 
   const [anonymousViewerData] = await Promise.all([
     createNewAnonymousCookie({ platformDetails, deviceToken }),
     result.type === 'invalidated' ? deleteCookie(result.cookieID) : null,
   ]);
 
   return createViewerForInvalidFetchViewerResult(result, anonymousViewerData);
 }
 
 function createViewerForInvalidFetchViewerResult(
   result: InvalidFetchViewerResult,
   anonymousViewerData: AnonymousViewerData,
 ): Viewer {
   // If a null cookie was specified in the request body, result.cookieSource
   // will still be BODY here. The only way it would be null or undefined here
   // is if there was no cookie specified in either the body or the header, in
   // which case we default to returning the new cookie in the response header.
   const cookieSource =
     result.cookieSource !== null && result.cookieSource !== undefined
       ? result.cookieSource
       : cookieSources.HEADER;
   const viewer = new Viewer({
     ...anonymousViewerData,
     cookieSource,
     sessionIdentifierType: result.sessionParameterInfo.sessionIdentifierType,
     isSocket: result.sessionParameterInfo.isSocket,
     ipAddress: result.sessionParameterInfo.ipAddress,
     userAgent: result.sessionParameterInfo.userAgent,
   });
   viewer.sessionChanged = true;
 
   // If cookieName is falsey, that tells us that there was no cookie specified
   // in the request, which means we can't be invalidating anything.
   if (result.cookieName) {
     viewer.cookieInvalidated = true;
     viewer.initialCookieName = result.cookieName;
   }
 
   return viewer;
 }
 
 function addSessionChangeInfoToResult(
   viewer: Viewer,
   res: $Response,
   result: Object,
   appURLFacts: AppURLFacts,
 ) {
   let threadInfos = {},
     userInfos = {};
   if (result.cookieChange) {
     ({ threadInfos, userInfos } = result.cookieChange);
   }
   let sessionChange;
   if (viewer.cookieInvalidated) {
     sessionChange = ({
       cookieInvalidated: true,
       threadInfos,
       userInfos: (values(userInfos).map(a => a): UserInfo[]),
       currentUserInfo: {
         id: viewer.cookieID,
         anonymous: true,
       },
     }: ServerSessionChange);
   } else {
     sessionChange = ({
       cookieInvalidated: false,
       threadInfos,
       userInfos: (values(userInfos).map(a => a): UserInfo[]),
     }: ServerSessionChange);
   }
   if (viewer.cookieSource === cookieSources.BODY) {
     sessionChange.cookie = viewer.cookiePairString;
   } else {
     addActualHTTPCookie(viewer, res, appURLFacts);
   }
   if (viewer.sessionIdentifierType === sessionIdentifierTypes.BODY_SESSION_ID) {
     sessionChange.sessionID = viewer.sessionID ? viewer.sessionID : null;
   }
   result.cookieChange = sessionChange;
 }
 
 type AnonymousCookieCreationParams = Shape<{
   +platformDetails: ?PlatformDetails,
   +deviceToken: ?string,
 }>;
 const defaultPlatformDetails = {};
 
 // The result of this function should not be passed directly to the Viewer
 // constructor. Instead, it should be passed to viewer.setNewCookie. There are
 // several fields on AnonymousViewerData that are not set by this function:
 // sessionIdentifierType, cookieSource, ipAddress, and userAgent. These
 // parameters all depend on the initial request. If the result of this function
 // is passed to the Viewer constructor directly, the resultant Viewer object
 // will throw whenever anybody attempts to access the relevant properties.
 async function createNewAnonymousCookie(
   params: AnonymousCookieCreationParams,
 ): Promise<AnonymousViewerData> {
   const { platformDetails, deviceToken } = params;
   const { platform, ...versions } = platformDetails || defaultPlatformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
 
   const time = Date.now();
   const cookiePassword = crypto.randomBytes(32).toString('hex');
   const cookieHash = getCookieHash(cookiePassword);
   const [[id]] = await Promise.all([
     createIDs('cookies', 1),
     deviceToken ? clearDeviceToken(deviceToken) : undefined,
   ]);
 
   const cookieRow = [
     id,
     cookieHash,
     null,
     platform,
     time,
     time,
     deviceToken,
     versionsString,
   ];
   const query = SQL`
     INSERT INTO cookies(id, hash, user, platform, creation_time, last_used,
       device_token, versions)
     VALUES ${[cookieRow]}
   `;
   await dbQuery(query);
   return {
     loggedIn: false,
     id,
     platformDetails,
     deviceToken,
     cookieID: id,
     cookiePassword,
     cookieHash,
     sessionID: undefined,
     sessionInfo: null,
     cookieInsertedThisRequest: true,
     isScriptViewer: false,
   };
 }
 
 type UserCookieCreationParams = {
   +platformDetails: PlatformDetails,
   +deviceToken?: ?string,
   +socialProof?: ?SIWESocialProof,
   +signedIdentityKeysBlob?: ?SignedIdentityKeysBlob,
 };
 
 // The result of this function should never be passed directly to the Viewer
 // constructor. Instead, it should be passed to viewer.setNewCookie. There are
 // several fields on UserViewerData that are not set by this function:
 // sessionID, sessionIdentifierType, cookieSource, and ipAddress. These
 // parameters all depend on the initial request. If the result of this function
 // is passed to the Viewer constructor directly, the resultant Viewer object
 // will throw whenever anybody attempts to access the relevant properties.
 async function createNewUserCookie(
   userID: string,
   params: UserCookieCreationParams,
 ): Promise<UserViewerData> {
   const { platformDetails, deviceToken, socialProof, signedIdentityKeysBlob } =
     params;
   const { platform, ...versions } = platformDetails || defaultPlatformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
 
   const time = Date.now();
   const cookiePassword = crypto.randomBytes(32).toString('hex');
   const cookieHash = getCookieHash(cookiePassword);
   const [[cookieID]] = await Promise.all([
     createIDs('cookies', 1),
     deviceToken ? clearDeviceToken(deviceToken) : undefined,
   ]);
 
   const cookieRow = [
     cookieID,
     cookieHash,
     userID,
     platform,
     time,
     time,
     deviceToken,
     versionsString,
     JSON.stringify(socialProof),
     signedIdentityKeysBlob ? JSON.stringify(signedIdentityKeysBlob) : null,
   ];
   const query = SQL`
     INSERT INTO cookies(id, hash, user, platform, creation_time, last_used,
       device_token, versions, social_proof, signed_identity_keys)
     VALUES ${[cookieRow]}
   `;
   await dbQuery(query);
   return {
     loggedIn: true,
     id: userID,
     platformDetails,
     deviceToken,
     userID,
     cookieID,
     sessionID: undefined,
     sessionInfo: null,
     cookiePassword,
     cookieHash,
     cookieInsertedThisRequest: true,
     isScriptViewer: false,
   };
 }
 
 // This gets called after createNewUserCookie and from websiteResponder. If the
 // Viewer's sessionIdentifierType is COOKIE_ID then the cookieID is used as the
 // session identifier; otherwise, a new ID is created for the session.
 async function setNewSession(
   viewer: Viewer,
   calendarQuery: CalendarQuery,
   initialLastUpdate: number,
 ): Promise<void> {
   if (viewer.sessionIdentifierType !== sessionIdentifierTypes.COOKIE_ID) {
     const [sessionID] = await createIDs('sessions', 1);
     viewer.setSessionID(sessionID);
   }
   await createSession(viewer, calendarQuery, initialLastUpdate);
 }
 
 async function updateCookie(viewer: Viewer) {
   const time = Date.now();
   const { cookieID, cookieHash, cookiePassword } = viewer;
 
   const updateObj = {};
   updateObj.last_used = time;
   if (isBcryptHash(cookieHash)) {
     updateObj.hash = getCookieHash(cookiePassword);
   }
   const query = SQL`
     UPDATE cookies SET ${updateObj} WHERE id = ${cookieID}
   `;
   await dbQuery(query);
 }
 
 function addCookieToJSONResponse(
   viewer: Viewer,
   res: $Response,
   result: Object,
   expectCookieInvalidation: boolean,
   appURLFacts: AppURLFacts,
 ) {
   if (expectCookieInvalidation) {
     viewer.cookieInvalidated = false;
   }
   if (!viewer.getData().cookieInsertedThisRequest) {
     handleAsyncPromise(updateCookie(viewer));
   }
   if (viewer.sessionChanged) {
     addSessionChangeInfoToResult(viewer, res, result, appURLFacts);
   } else if (viewer.cookieSource !== cookieSources.BODY) {
     addActualHTTPCookie(viewer, res, appURLFacts);
   }
 }
 
 function addCookieToHomeResponse(
   viewer: Viewer,
   res: $Response,
   appURLFacts: AppURLFacts,
 ) {
   if (!viewer.getData().cookieInsertedThisRequest) {
     handleAsyncPromise(updateCookie(viewer));
   }
   addActualHTTPCookie(viewer, res, appURLFacts);
 }
 
 function getCookieOptions(appURLFacts: AppURLFacts) {
   const { baseDomain, basePath, https } = appURLFacts;
   const domainAsURL = new url.URL(baseDomain);
   return {
     domain: domainAsURL.hostname,
     path: basePath,
-    httpOnly: true,
+    httpOnly: false,
     secure: https,
     maxAge: cookieLifetime,
     sameSite: 'Strict',
   };
 }
 
 function addActualHTTPCookie(
   viewer: Viewer,
   res: $Response,
   appURLFacts: AppURLFacts,
 ) {
   res.cookie(
     viewer.cookieName,
     viewer.cookieString,
     getCookieOptions(appURLFacts),
   );
   if (viewer.cookieName !== viewer.initialCookieName) {
     res.clearCookie(viewer.initialCookieName, getCookieOptions(appURLFacts));
   }
 }
 
 async function setCookieSignedIdentityKeysBlob(
   cookieID: string,
   signedIdentityKeysBlob: SignedIdentityKeysBlob,
 ) {
   const signedIdentityKeysStr = JSON.stringify(signedIdentityKeysBlob);
   const query = SQL`
     UPDATE cookies 
     SET signed_identity_keys = ${signedIdentityKeysStr}
     WHERE id = ${cookieID}
   `;
   await dbQuery(query);
 }
 
 // Returns `true` if row with `id = cookieID` exists AND
 // `signed_identity_keys` is `NULL`. Otherwise, returns `false`.
 async function isCookieMissingSignedIdentityKeysBlob(
   cookieID: string,
 ): Promise<boolean> {
   const query = SQL`
     SELECT signed_identity_keys
     FROM cookies 
     WHERE id = ${cookieID}
   `;
   const [queryResult] = await dbQuery(query);
   return (
     queryResult.length === 1 && queryResult[0].signed_identity_keys === null
   );
 }
 
 async function isCookieMissingOlmNotificationsSession(
   viewer: Viewer,
 ): Promise<boolean> {
   if (
     !viewer.platformDetails ||
     (viewer.platformDetails.platform !== 'ios' &&
       viewer.platformDetails.platform !== 'android') ||
     !viewer.platformDetails.codeVersion ||
     viewer.platformDetails.codeVersion <= 222
   ) {
     return false;
   }
   const query = SQL`
     SELECT COUNT(*) AS count
     FROM olm_sessions
     WHERE cookie_id = ${viewer.cookieID} AND is_content = FALSE
   `;
   const [queryResult] = await dbQuery(query);
   return queryResult[0].count === 0;
 }
 
 async function setCookiePlatform(
   viewer: Viewer,
   platform: Platform,
 ): Promise<void> {
   const newPlatformDetails = { ...viewer.platformDetails, platform };
   viewer.setPlatformDetails(newPlatformDetails);
   const query = SQL`
     UPDATE cookies
     SET platform = ${platform}
     WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 async function setCookiePlatformDetails(
   viewer: Viewer,
   platformDetails: PlatformDetails,
 ): Promise<void> {
   viewer.setPlatformDetails(platformDetails);
   const { platform, ...versions } = platformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
   const query = SQL`
     UPDATE cookies
     SET platform = ${platform}, versions = ${versionsString}
     WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 export {
   fetchViewerForJSONRequest,
   fetchViewerForHomeRequest,
   fetchViewerForSocket,
   createNewAnonymousCookie,
   createNewUserCookie,
   setNewSession,
   updateCookie,
   addCookieToJSONResponse,
   addCookieToHomeResponse,
   setCookieSignedIdentityKeysBlob,
   isCookieMissingSignedIdentityKeysBlob,
   setCookiePlatform,
   setCookiePlatformDetails,
   isCookieMissingOlmNotificationsSession,
 };
diff --git a/lib/types/keyserver-types.js b/lib/types/keyserver-types.js
index 7a1038a4c..36e461dfd 100644
--- a/lib/types/keyserver-types.js
+++ b/lib/types/keyserver-types.js
@@ -1,39 +1,36 @@
 // @flow
 
 import t, { type TInterface } from 'tcomb';
 
 import type { PlatformDetails } from './device-types.js';
 import { connectionInfoValidator } from './socket-types.js';
 import type { ConnectionInfo } from './socket-types.js';
 import { tShape, tPlatformDetails } from '../utils/validation-utils.js';
 
-// Once we start using the cookie field on web,
-// the cookie field should be mandatory, of type ?string.
-// See https://linear.app/comm/issue/ENG-4347/stop-using-browser-cookies
 export type KeyserverInfo = {
-  +cookie?: ?string,
+  +cookie: ?string,
   +sessionID?: ?string,
   +updatesCurrentAsOf: number, // millisecond timestamp
   +urlPrefix: string,
   +connection: ConnectionInfo,
   +lastCommunicatedPlatformDetails: ?PlatformDetails,
 };
 
 export type KeyserverStore = {
   +keyserverInfos: { +[key: string]: KeyserverInfo },
 };
 
 export const keyserverInfoValidator: TInterface<KeyserverInfo> =
   tShape<KeyserverInfo>({
     cookie: t.maybe(t.String),
     sessionID: t.maybe(t.String),
     updatesCurrentAsOf: t.Number,
     urlPrefix: t.String,
     connection: connectionInfoValidator,
     lastCommunicatedPlatformDetails: t.maybe(tPlatformDetails),
   });
 
 export const keyserverStoreValidator: TInterface<KeyserverStore> =
   tShape<KeyserverStore>({
     keyserverInfos: t.dict(t.String, keyserverInfoValidator),
   });
diff --git a/lib/utils/cookie-utils.js b/lib/utils/cookie-utils.js
new file mode 100644
index 000000000..453e1d728
--- /dev/null
+++ b/lib/utils/cookie-utils.js
@@ -0,0 +1,14 @@
+// @flow
+
+function parseCookies(header: string): { +[string]: string } {
+  const values = header.split(';').map(v => v.split('='));
+
+  const cookies = {};
+  for (const [key, value] of values) {
+    cookies[decodeURIComponent(key.trim())] = decodeURIComponent(value.trim());
+  }
+
+  return cookies;
+}
+
+export { parseCookies };
diff --git a/native/redux/default-state.js b/native/redux/default-state.js
index acfcf023c..cd86516ac 100644
--- a/native/redux/default-state.js
+++ b/native/redux/default-state.js
@@ -1,91 +1,92 @@
 // @flow
 
 import { Platform } from 'react-native';
 import Orientation from 'react-native-orientation-locker';
 
 import { defaultEnabledApps } from 'lib/types/enabled-apps.js';
 import { defaultCalendarQuery } from 'lib/types/entry-types.js';
 import { defaultCalendarFilters } from 'lib/types/filter-types.js';
 import { defaultConnectionInfo } from 'lib/types/socket-types.js';
 import { defaultGlobalThemeInfo } from 'lib/types/theme-types.js';
 import { defaultNotifPermissionAlertInfo } from 'lib/utils/push-alerts.js';
 import { ashoatKeyserverID } from 'lib/utils/validation-utils.js';
 
 import { defaultDimensionsInfo } from './dimensions-updater.react.js';
 import type { AppState } from './state-types.js';
 import { defaultNavInfo } from '../navigation/default-state.js';
 import { defaultDeviceCameraInfo } from '../types/camera.js';
 import { defaultConnectivityInfo } from '../types/connectivity.js';
 import { defaultURLPrefix, natNodeServer } from '../utils/url-utils.js';
 
 const defaultState = ({
   navInfo: defaultNavInfo,
   currentUserInfo: null,
   draftStore: { drafts: {} },
   entryStore: {
     entryInfos: {},
     daysToEntries: {},
     lastUserInteractionCalendar: 0,
   },
   threadStore: {
     threadInfos: {},
   },
   userStore: {
     userInfos: {},
   },
   messageStore: {
     messages: {},
     threads: {},
     local: {},
     currentAsOf: { [ashoatKeyserverID]: 0 },
   },
   storeLoaded: false,
   loadingStatuses: {},
   calendarFilters: defaultCalendarFilters,
   deviceToken: null,
   dataLoaded: false,
   customServer: natNodeServer,
   notifPermissionAlertInfo: defaultNotifPermissionAlertInfo,
   actualizedCalendarQuery: defaultCalendarQuery(Platform.OS),
   watchedThreadIDs: [],
   lifecycleState: 'active',
   enabledApps: defaultEnabledApps,
   reportStore: {
     enabledReports: {
       crashReports: __DEV__,
       inconsistencyReports: __DEV__,
       mediaReports: __DEV__,
     },
     queuedReports: [],
   },
   nextLocalID: 0,
   _persist: null,
   dimensions: defaultDimensionsInfo,
   connectivity: defaultConnectivityInfo,
   globalThemeInfo: defaultGlobalThemeInfo,
   deviceCameraInfo: defaultDeviceCameraInfo,
   deviceOrientation: Orientation.getInitialOrientation(),
   frozen: false,
   userPolicies: {},
   commServicesAccessToken: null,
   inviteLinksStore: {
     links: {},
   },
   keyserverStore: {
     keyserverInfos: {
       [ashoatKeyserverID]: {
+        cookie: null,
         updatesCurrentAsOf: 0,
         urlPrefix: defaultURLPrefix,
         connection: defaultConnectionInfo,
         lastCommunicatedPlatformDetails: null,
       },
     },
   },
   localSettings: {
     isBackupEnabled: false,
   },
   threadActivityStore: {},
   integrityStore: { threadHashes: {}, threadHashingStatus: 'starting' },
 }: AppState);
 
 export { defaultState };
diff --git a/web/redux/default-state.js b/web/redux/default-state.js
index bcfd705f7..cb9829c12 100644
--- a/web/redux/default-state.js
+++ b/web/redux/default-state.js
@@ -1,94 +1,95 @@
 // @flow
 
 import { defaultEnabledApps } from 'lib/types/enabled-apps.js';
 import { defaultCalendarFilters } from 'lib/types/filter-types.js';
 import { defaultConnectionInfo } from 'lib/types/socket-types.js';
 import { isDev } from 'lib/utils/dev-utils.js';
 import { defaultNotifPermissionAlertInfo } from 'lib/utils/push-alerts.js';
 import { ashoatKeyserverID } from 'lib/utils/validation-utils.js';
 
 import type { AppState } from './redux-setup.js';
 
 const defaultWebState: AppState = Object.freeze({
   navInfo: {
     activeChatThreadID: null,
     startDate: '',
     endDate: '',
     tab: 'chat',
   },
   currentUserInfo: null,
   draftStore: { drafts: {} },
   entryStore: {
     entryInfos: {},
     daysToEntries: {},
     lastUserInteractionCalendar: 0,
   },
   threadStore: {
     threadInfos: {},
   },
   userStore: {
     userInfos: {},
   },
   messageStore: {
     messages: {},
     threads: {},
     local: {},
     currentAsOf: { [ashoatKeyserverID]: 0 },
   },
   windowActive: true,
   pushApiPublicKey: null,
   cryptoStore: {
     primaryAccount: null,
     primaryIdentityKeys: null,
     notificationAccount: null,
     notificationIdentityKeys: null,
   },
   deviceID: null,
   windowDimensions: { width: window.width, height: window.height },
   loadingStatuses: {},
   calendarFilters: defaultCalendarFilters,
   deviceToken: null,
   dataLoaded: false,
   notifPermissionAlertInfo: defaultNotifPermissionAlertInfo,
   watchedThreadIDs: [],
   lifecycleState: 'active',
   enabledApps: defaultEnabledApps,
   reportStore: {
     enabledReports: {
       crashReports: false,
       inconsistencyReports: false,
       mediaReports: false,
     },
     queuedReports: [],
   },
   nextLocalID: 0,
   _persist: null,
   userPolicies: {},
   commServicesAccessToken: null,
   inviteLinksStore: {
     links: {},
   },
   actualizedCalendarQuery: {
     startDate: '',
     endDate: '',
     filters: defaultCalendarFilters,
   },
   communityPickerStore: { chat: null, calendar: null },
   keyserverStore: {
     keyserverInfos: {
       [ashoatKeyserverID]: {
+        cookie: null,
         updatesCurrentAsOf: 0,
         urlPrefix: isDev
           ? 'http://localhost:3000/comm'
           : 'https://web.comm.app',
         connection: { ...defaultConnectionInfo },
         lastCommunicatedPlatformDetails: null,
       },
     },
   },
   threadActivityStore: {},
   initialStateLoaded: false,
   integrityStore: { threadHashes: {}, threadHashingStatus: 'starting' },
 });
 
 export { defaultWebState };
diff --git a/web/redux/persist.js b/web/redux/persist.js
index 9e41418ad..a053f5449 100644
--- a/web/redux/persist.js
+++ b/web/redux/persist.js
@@ -1,253 +1,282 @@
 // @flow
 
 import invariant from 'invariant';
 import {
   getStoredState,
   purgeStoredState,
   createTransform,
 } from 'redux-persist';
 import storage from 'redux-persist/es/storage/index.js';
 import type { Transform } from 'redux-persist/es/types.js';
 import type { PersistConfig } from 'redux-persist/src/types.js';
 
 import {
   createAsyncMigrate,
   type StorageMigrationFunction,
 } from 'lib/shared/create-async-migrate.js';
 import type {
   KeyserverInfo,
   KeyserverStore,
 } from 'lib/types/keyserver-types.js';
+import { cookieTypes } from 'lib/types/session-types.js';
 import {
   defaultConnectionInfo,
   type ConnectionInfo,
 } from 'lib/types/socket-types.js';
+import { parseCookies } from 'lib/utils/cookie-utils.js';
 import { isDev } from 'lib/utils/dev-utils.js';
 import {
   generateIDSchemaMigrationOpsForDrafts,
   convertDraftStoreToNewIDSchema,
 } from 'lib/utils/migration-utils.js';
 import { ashoatKeyserverID } from 'lib/utils/validation-utils.js';
 
 import commReduxStorageEngine from './comm-redux-storage-engine.js';
 import type { AppState } from './redux-setup.js';
 import { getDatabaseModule } from '../database/database-module-provider.js';
 import { isSQLiteSupported } from '../database/utils/db-utils.js';
 import { workerRequestMessageTypes } from '../types/worker-types.js';
 
 const migrations = {
   [1]: async state => {
     const {
       primaryIdentityPublicKey,
       ...stateWithoutPrimaryIdentityPublicKey
     } = state;
     return {
       ...stateWithoutPrimaryIdentityPublicKey,
       cryptoStore: {
         primaryAccount: null,
         primaryIdentityKeys: null,
         notificationAccount: null,
         notificationIdentityKeys: null,
       },
     };
   },
   [2]: async state => {
     return state;
   },
   [3]: async (state: AppState) => {
     let newState = state;
     if (state.draftStore) {
       newState = {
         ...newState,
         draftStore: convertDraftStoreToNewIDSchema(state.draftStore),
       };
     }
 
     const databaseModule = await getDatabaseModule();
     const isDatabaseSupported = await databaseModule.isDatabaseSupported();
 
     if (!isDatabaseSupported) {
       return newState;
     }
 
     const stores = await databaseModule.schedule({
       type: workerRequestMessageTypes.GET_CLIENT_STORE,
     });
     invariant(stores?.store, 'Stores should exist');
     await databaseModule.schedule({
       type: workerRequestMessageTypes.PROCESS_STORE_OPERATIONS,
       storeOperations: {
         draftStoreOperations: generateIDSchemaMigrationOpsForDrafts(
           stores.store.drafts,
         ),
       },
     });
 
     return newState;
   },
   [4]: async state => {
     const { lastCommunicatedPlatformDetails, keyserverStore, ...rest } = state;
 
     return {
       ...rest,
       keyserverStore: {
         ...keyserverStore,
         keyserverInfos: {
           ...keyserverStore.keyserverInfos,
           [ashoatKeyserverID]: {
             ...keyserverStore.keyserverInfos[ashoatKeyserverID],
             lastCommunicatedPlatformDetails,
           },
         },
       },
     };
   },
   [5]: async state => {
     const databaseModule = await getDatabaseModule();
     const isDatabaseSupported = await databaseModule.isDatabaseSupported();
     if (!isDatabaseSupported) {
       return state;
     }
 
     if (!state.draftStore) {
       return state;
     }
 
     const { drafts } = state.draftStore;
     const draftStoreOperations = [];
     for (const key in drafts) {
       const text = drafts[key];
       draftStoreOperations.push({
         type: 'update',
         payload: { key, text },
       });
     }
 
     await databaseModule.schedule({
       type: workerRequestMessageTypes.PROCESS_STORE_OPERATIONS,
       storeOperations: { draftStoreOperations },
     });
 
     return state;
   },
   [6]: async state => ({
     ...state,
     integrityStore: { threadHashes: {}, threadHashingStatus: 'starting' },
   }),
+  [7]: async (state: AppState): Promise<AppState> => {
+    if (!document.cookie) {
+      return state;
+    }
+
+    const params = parseCookies(document.cookie);
+    let cookie = null;
+    if (params[cookieTypes.USER]) {
+      cookie = `${cookieTypes.USER}=${params[cookieTypes.USER]}`;
+    } else if (params[cookieTypes.ANONYMOUS]) {
+      cookie = `${cookieTypes.ANONYMOUS}=${params[cookieTypes.ANONYMOUS]}`;
+    }
+
+    return {
+      ...state,
+      keyserverStore: {
+        ...state.keyserverStore,
+        keyserverInfos: {
+          ...state.keyserverStore.keyserverInfos,
+          [ashoatKeyserverID]: {
+            ...state.keyserverStore.keyserverInfos[ashoatKeyserverID],
+            cookie,
+          },
+        },
+      },
+    };
+  },
 };
 
 const persistWhitelist = [
   'enabledApps',
   'deviceID',
   'cryptoStore',
   'notifPermissionAlertInfo',
   'commServicesAccessToken',
   'keyserverStore',
 ];
 
 const rootKey = 'root';
 
 const migrateStorageToSQLite: StorageMigrationFunction = async debug => {
   const databaseModule = await getDatabaseModule();
   const isSupported = await databaseModule.isDatabaseSupported();
   if (!isSupported) {
     return undefined;
   }
 
   const oldStorage = await getStoredState({ storage, key: rootKey });
   if (!oldStorage) {
     return undefined;
   }
 
   purgeStoredState({ storage, key: rootKey });
   if (debug) {
     console.log('redux-persist: migrating state to SQLite storage');
   }
 
   // We need to simulate the keyserverStoreTransform for data stored in the
   // old local storage (because redux persist will only run it for the
   // sqlite storage which is empty in this case).
   // We don't just use keyserverStoreTransform.out(oldStorage) because
   // the transform might change in the future, but we need to treat
   // this code like migration code (it shouldn't change).
   if (oldStorage?._persist?.version === 4) {
     const defaultConnection = defaultConnectionInfo;
     return {
       ...oldStorage,
       keyserverStore: {
         ...oldStorage.keyserverStore,
         keyserverInfos: {
           ...oldStorage.keyserverStore.keyserverInfos,
           [ashoatKeyserverID]: {
             ...oldStorage.keyserverStore.keyserverInfos[ashoatKeyserverID],
             connection: { ...defaultConnection },
             updatesCurrentAsOf: 0,
             sessionID: null,
           },
         },
       },
     };
   }
 
   return oldStorage;
 };
 
 type PersistedKeyserverInfo = $Diff<
   KeyserverInfo,
   {
     +connection: ConnectionInfo,
     +updatesCurrentAsOf: number,
     +sessionID?: ?string,
   },
 >;
 type PersistedKeyserverStore = {
   +keyserverInfos: { +[key: string]: PersistedKeyserverInfo },
 };
 const keyserverStoreTransform: Transform = createTransform(
   (state: KeyserverStore): PersistedKeyserverStore => {
     const keyserverInfos = {};
     for (const key in state.keyserverInfos) {
       const { connection, updatesCurrentAsOf, sessionID, ...rest } =
         state.keyserverInfos[key];
       keyserverInfos[key] = rest;
     }
     return {
       ...state,
       keyserverInfos,
     };
   },
   (state: PersistedKeyserverStore): KeyserverStore => {
     const keyserverInfos = {};
     const defaultConnection = defaultConnectionInfo;
     for (const key in state.keyserverInfos) {
       keyserverInfos[key] = {
         ...state.keyserverInfos[key],
         connection: { ...defaultConnection },
         updatesCurrentAsOf: 0,
         sessionID: null,
       };
     }
     return {
       ...state,
       keyserverInfos,
     };
   },
   { whitelist: ['keyserverStore'] },
 );
 
 const persistConfig: PersistConfig = {
   key: rootKey,
   storage: commReduxStorageEngine,
   whitelist: isSQLiteSupported()
     ? persistWhitelist
     : [...persistWhitelist, 'draftStore'],
   migrate: (createAsyncMigrate(
     migrations,
     { debug: isDev },
     migrateStorageToSQLite,
   ): any),
-  version: 6,
+  version: 7,
   transforms: [keyserverStoreTransform],
 };
 
 export { persistConfig };