- Shipped
- September 24, 2026 at 12:12 AM UTC
- Author
- Kamo
- Commit
- 5e771ef
/api/validate is where a tab first learns its session, and it returned the 128-hex *** id for the page to keep in sessionStorage — readable by any script running in the page, and a usable session from anywhere once read. It now returns a HANDLE: the id sealed (app/lib/sessionHandle, shipped in 3e3c3e7a) under SESSION_HANDLE_SECRET and this browser's key, which is planted here the first time as an HttpOnly __Host-KBK cookie. The page stores and sends the handle exactly as it did the id; proxy.ts opens it into the id for every /api route; WebSockets authenticate with one-time keys (previous commit). Script can still act in its own page, but it can no longer carry the session off: the handle does not open in any other browser. Without SESSION_HANDLE_SECRET (a local run) the id is handed over as before. Tabs validated before this keep their hex ids, which the proxy passes through until they age out. validateHandle.test.ts: handle + HttpOnly key that opens it; an existing key is reused; no secret -> the id (2 of 3 red with the old response).