- Ya
- 24 Septemba 2026, 00:09 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 3e3c3e7
*** was set readable (httpOnly:false) and several responses handed the raw session id to the browser. Page script cannot use a cookie's HttpOnly flag if an endpoint reads the value back out: - /api/session/extend and /api/session/info returned sessionInfo.sessionId, /api/user-info returned it as tokenId, /api/debug/cookies as ***Value. They now return an 8-character preview (the only consumer was the System Debug screen) or nothing. - /valid is served with no session gate and rendered every cookie VALUE into the page — on the server, which sees HttpOnly cookies too. It now shows names and sizes. - /api/session/extend plants *** with httpOnly: true. The browser still sends it to the EventSources, <img>/<video> and /meet/join that depend on it; script can no longer read it. - **************** now also fails any *** cookie planted readable. Groundwork for the next step, inert until /api/validate starts issuing handles: - app/lib/sessionHandle.ts: a tab's session HANDLE is the 128-hex id sealed with AES-256-GCM under a key derived (HKDF) from SESSION_HANDLE_SECRET and a random per-browser key in an HttpOnly __Host-KBK cookie. Exactly 128 characters, so every existing client check accepts it; useless in any other browser; tampering fails the tag. sessionHandle.test.ts covers seal/open, foreign browser, tampering, no secret. - proxy.ts opens a handle arriving in X-***-Token into the real id for the route, so the ~180 routes that read that header need no change; a handle that does not open drops both the header and the shared *** cookie rather than letting the route fall back to another tab's session. The matcher now includes /api/:path* explicitly (the static-file rule skipped /api/*.png). - /api/generate-otk gains purpose=ws (30 s) for WebSocket handshakes; logout keeps the browser key (other tabs' handles depend on it). - k8s/deployment.yaml mounts the kamo-internal-session-handle Secret (created in the cluster).