@@ -115,7 +115,10 @@ export const getToken = () => {
 
 /** Get the saved client token to warm the transport before the app mounts. */
 const peekToken = () =>
-  getToken() || window.sessionStorage.getItem("token") || "";
+  token ||
+  window.sessionStorage.getItem(`${sessionStorageKey()}:token`) ||
+  window.sessionStorage.getItem("token") ||
+  "";
 
 /**
  * Get the URL for the backend server
@@ -276,6 +279,16 @@ if (typeof window !== "undefined") {
       return;
     }
     try {
+      // A cold transport would capture cookies before the shared session lock.
+      if (
+        !(
+          Number(
+            window.localStorage.getItem(`${sessionStorageKey()}:expires_at`),
+          ) > Date.now()
+        )
+      ) {
+        return;
+      }
       warmSocket = createSocket(
         getBackendURL(EVENTURL),
         [env.TRANSPORT],
@@ -832,7 +845,6 @@ export const connect = async (
     warmSocket ?? createSocket(endpoint, transports, session_token);
   warmSocket = null;
   cancelWarmup();
-  socket.current.auth = bootAuth(true);
   socket.current.wait_connect = false;
   let firstConnect = true;
   let finishBootstrap;
 
@@ -10,6 +10,7 @@ const source = await readFile(
   ),
   "utf8",
 );
+const tokenKey = "reflex:ws://localhost:8000/_event:token";
 
 /** Evaluate the actual frontend module with controlled transport and browser APIs. */
 async function setup({
@@ -26,11 +27,14 @@ async function setup({
   const updates = [];
   const window = new EventTarget();
   window.location = new URL("http://localhost:3000/page?query=value");
-  const storage = new Map(storedToken ? [["token", storedToken]] : []);
+  const storage = new Map(storedToken ? [[tokenKey, storedToken]] : []);
   window.sessionStorage = {
     getItem: (key) => storage.get(key),
     setItem: (key, value) => storage.set(key, value),
   };
+  window.localStorage = {
+    getItem: () => (storedToken ? String(Date.now() + 3600000) : undefined),
+  };
   const document = new EventTarget();
   document.cookie = disabled ? "backend-enabled=false" : "";
   document.visibilityState = hidden ? "hidden" : "visible";
@@ -194,34 +198,31 @@ test("warm the transport without hydrating, then reuse it with every handler att
   assert.deepEqual(app.updates, [7]);
   assert.deepEqual(app.firstHydrates, [true]);
   assert.equal(app.timers.size, 0);
-  assert.equal(app.window.sessionStorage.getItem("token"), "assigned-token");
+  assert.equal(app.window.sessionStorage.getItem(tokenKey), "assigned-token");
   assert.equal(app.socket.current.auth.event.router_data.pathname, "/page");
 });
 
-test("a new session's token is saved only once the mounted app connects", async () => {
+test("a cold session stores only the token assigned by the server", async () => {
   const app = await setup({ storedToken: null });
   app.flush();
-  const warm = app.sockets[0];
-  const token = warm.io.opts.query.token;
-  assert.ok(token);
-  // Waiting for the token in session storage must mean the app has mounted.
-  assert.equal(app.window.sessionStorage.getItem("token"), undefined);
+  assert.equal(app.sockets.length, 0);
+  assert.equal(app.window.sessionStorage.getItem(tokenKey), undefined);
   const saved = [];
   const setItem = app.window.sessionStorage.setItem;
   app.window.sessionStorage.setItem = (key, value) => {
     saved.push(value);
     setItem(key, value);
   };
   await app.connect();
-  assert.equal(app.socket.current, warm);
-  assert.deepEqual(saved, [token, "assigned-token"]);
+  assert.equal(app.socket.current.io.opts.query.token, "");
+  assert.deepEqual(saved, ["assigned-token"]);
 });
 
 test("a warm transport carrying another session's token is replaced", async () => {
   const app = await setup();
   app.flush();
   const warm = app.sockets[0];
-  app.window.sessionStorage.setItem("token", "replaced-token");
+  app.window.sessionStorage.setItem(tokenKey, "replaced-token");
   await app.connect();
   assert.equal(warm.disconnects, 1);
   assert.equal(app.sockets.length, 2);
 
@@ -3,7 +3,7 @@ import { SourceTextModule, SyntheticModule } from "node:vm";
 /** Evaluate the complete frontend module with isolated dependency stubs. */
 export async function createQueueRuntime(
   source,
-  { uploadFiles, throttle, io, env, browser } = {},
+  { uploadFiles, throttle, io, env, browser, initialState = {} } = {},
 ) {
   const unused = () => {
     throw new Error("Unexpected frontend dependency in queue test");
@@ -15,7 +15,7 @@ export async function createQueueRuntime(
         payload: first ? { hashes: { test_state: "compiled-defaults" } } : {},
       },
     ],
-    initialState: {},
+    initialState,
     onLoadInternalEvent: unused,
     state_name: "test_state",
     exception_state_name: "test_exception_state",
 
@@ -36,12 +36,14 @@ async function browserSession({
   localStorage = storage(),
   sessionStorage = storage(),
   webLocks,
+  warm = false,
   eventURL = "ws://localhost:8000/prefix/_event",
 } = {}) {
   const callbacks = new Map();
   const timeouts = new Map();
   const errors = [];
   const connections = [];
+  const warmups = [];
   const requests = [];
   const emitted = [];
   const uploads = [];
@@ -76,15 +78,31 @@ async function browserSession({
     uploadFiles: (...args) => uploads.push(args),
     browser: {
       window,
-      document: { addEventListener() {}, removeEventListener() {} },
+      document: {
+        cookie: "",
+        visibilityState: "visible",
+        addEventListener() {},
+        removeEventListener() {},
+      },
       localStorage,
       sessionStorage,
     },
-    env: { EVENT: eventURL },
+    env: { EVENT: eventURL, TRANSPORT: "websocket" },
+    initialState: warm
+      ? { test_state: {}, test_exception_state: {} }
+      : undefined,
     io: (_url, options) => {
       const current = {
         connected: false,
-        io: { opts: options, encoder: {}, decoder: {} },
+        io: {
+          opts: options,
+          encoder: {},
+          decoder: {},
+          open(callback) {
+            warmups.push(options.query.token);
+            callback();
+          },
+        },
         on: (event, callback) => callbacks.set(event, callback),
         emit: (event, payload) => emitted.push([event, payload]),
         connect() {
@@ -107,6 +125,7 @@ async function browserSession({
     callbacks,
     timeouts,
     connections,
+    warmups,
     requests,
     emitted,
     uploads,
@@ -237,6 +256,7 @@ test("fresh hint reconnects directly without HTTP or a lock", async () => {
   await first.connect();
   await (await first.accept("existing-tab", "credential")).exchange;
   const tab = await browserSession({
+    warm: true,
     localStorage: first.localStorage,
     sessionStorage: first.sessionStorage,
     webLocks: {
@@ -245,6 +265,9 @@ test("fresh hint reconnects directly without HTTP or a lock", async () => {
       },
     },
   });
+  await tick();
+  assert.deepEqual(tab.warmups, ["existing-tab"]);
+  assert.deepEqual(tab.connections, []);
   await tab.connect();
   assert.deepEqual(tab.connections, ["existing-tab"]);
   assert.equal(tab.requests.length, 0);
@@ -256,6 +279,15 @@ test("fresh hint reconnects directly without HTTP or a lock", async () => {
   assert.equal(tab.requests.length, 0);
 });
 
+test("cold transport cannot capture cookies before the session lock", async () => {
+  const tab = await browserSession({ warm: true, webLocks: locks() });
+  await tick();
+  assert.deepEqual(tab.warmups, []);
+  await tab.connect();
+  assert.deepEqual(tab.connections, [""]);
+  await (await tab.accept("bound-tab", "credential")).exchange;
+});
+
 test("cookie-wins exchange adopts its token and reconnects the provisional socket", async () => {
   const tab = await browserSession({
     fetch: async () => ({