Securecookie cookies + Cookie key (BYO + leader-generated) #33

New issue

Closed

opened 2026-09-15 23:27:01 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-15 23:27:01 +00:00

Owner

Parent

#31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio

What to build

The Session and State cookies become signed+encrypted gorilla/securecookie blobs. The Session blob holds {idToken, refreshToken}; the State blob holds {appKey, nonce, returnTo}. A single bridge-level Cookie key (an HMAC hashKey + an AES blockKey) is shared by all replicas: if a key Secret already exists (BYO) the bridge uses it; otherwise the leader generates a strong random key and writes it create-if-absent. A cookie set by one replica must decode on any other.

Acceptance criteria

The Session and State cookies are encoded/decoded as securecookie blobs (signed + encrypted) and round-trip.
A tampered cookie, or one signed with a different key, is rejected (treated as no Session / no state).
The leader creates the Cookie key Secret when absent, leaves a BYO key Secret untouched, and is idempotent across re-runs.
All replicas share the same key (a cookie written by one replica decodes on another).
make test passes (serve cookie round-trip tests + leader key-authoring envtest).

Blocked by

None — can start immediately.

## Parent #31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio ## What to build The **Session** and **State** cookies become signed+encrypted `gorilla/securecookie` blobs. The Session blob holds `{idToken, refreshToken}`; the State blob holds `{appKey, nonce, returnTo}`. A single bridge-level **Cookie key** (an HMAC hashKey + an AES blockKey) is shared by all replicas: if a key Secret already exists (**BYO**) the bridge uses it; otherwise the **leader** generates a strong random key and writes it **create-if-absent**. A cookie set by one replica must decode on any other. ## Acceptance criteria - [ ] The Session and State cookies are encoded/decoded as securecookie blobs (signed + encrypted) and round-trip. - [ ] A tampered cookie, or one signed with a different key, is rejected (treated as no Session / no state). - [ ] The leader creates the Cookie key Secret when absent, leaves a BYO key Secret untouched, and is idempotent across re-runs. - [ ] All replicas share the same key (a cookie written by one replica decodes on another). - [ ] `make test` passes (serve cookie round-trip tests + leader key-authoring envtest). ## Blocked by - None — can start immediately.

ginjiruu referenced this issue

2026-09-15 23:27:18 +00:00

PKCE (always) + id_token nonce + public-client no-secret #36

ginjiruu referenced this issue

2026-09-15 23:27:28 +00:00

E2E: portable-cluster rip-and-replace re-run (OIDC + Exchange; #30 gateway gate) #37

ginjiruu added the

ready-for-agent

label

2026-09-15 23:27:34 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-16 00:38:22 +00:00