Securecookie Session/State cookies + leader-authored Cookie key #39

Merged

ginjiruu merged 1 commit from t33-securecookie into t32-public-client

2026-09-16 00:51:11 +00:00

ginjiruu commented

2026-09-16 00:38:22 +00:00

Owner

Closes #33

Migrate the Session and State/nonce cookies to signed+encrypted gorilla/securecookie blobs, keyed by a single bridge-level Cookie key (an HMAC hashKey + an AES blockKey) shared across all replicas. The key is BYO (a pre-existing Secret is used as-is, so cluster managers can create/rotate it) with a leader-generated create-if-absent fallback; every replica's mirror carries the codec in the Snapshot (no serving-path K8s read).

Session blob {id_token, refresh_token}; State blob {app_key, nonce, return_to} (pkce_verifier is added in #36).
A tampered cookie, or one signed with a different key, is rejected (no Session / no state); an absent key is fail-closed 5xx.
Leader key-authoring is create-if-absent, BYO-respecting, and idempotent (envtest-verified).

Stacked on #32. Part of the public-client + trio effort (spec #31).

Closes #33 Migrate the Session and State/nonce cookies to signed+encrypted `gorilla/securecookie` blobs, keyed by a single bridge-level **Cookie key** (an HMAC hashKey + an AES blockKey) shared across all replicas. The key is **BYO** (a pre-existing Secret is used as-is, so cluster managers can create/rotate it) with a **leader-generated create-if-absent** fallback; every replica's mirror carries the codec in the Snapshot (no serving-path K8s read). - Session blob `{id_token, refresh_token}`; State blob `{app_key, nonce, return_to}` (`pkce_verifier` is added in #36). - A tampered cookie, or one signed with a different key, is rejected (no Session / no state); an absent key is fail-closed 5xx. - Leader key-authoring is create-if-absent, BYO-respecting, and idempotent (envtest-verified). Stacked on #32. Part of the public-client + trio effort (spec #31).

ginjiruu added 1 commit

2026-09-16 00:38:22 +00:00

feat: securecookie Session/State cookies + leader-authored Cookie key (#33 )

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled