Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I1204

The session is signed, short, and revocable from the server

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
web-sign-in
Milestone status
PLANNED
Wave
3
Waiting on
I1203
Holds back
I1205I1207
Behind it in all
4
Evidence
0 of 3
In the waySubjectDetail
issueI1203I1203 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I1204

majordomus plan verify I1204

majordomus plan done I1204

What it is

Objective
Issue the session as a signed cookie carrying an opaque identifier, keep the server-side record needed to revoke it, set HttpOnly, SameSite and Secure according to how the surface is served, expire it, and implement sign-out as a server-side revocation rather than a cleared cookie.
Why
A cookie that only the browser can invalidate cannot be signed out of, and a session that carries claims in its payload cannot be revoked when the provider set changes underneath it.
Now
No cookie, no session, no signing key handling.
Wanted
A session exists as long as it is meant to, survives a restart only if that is the stated decision, and is gone from the server the moment sign-out is called.
Done when
unknown: the record declares no `completion`
Risk
A signing key with a compiled-in default is a signing key that ships. Its absence is a refusal to issue sessions, not a fallback.

Acceptance

  • The cookie is signed with a key that comes from the environment and is absent from every artifact
  • Secure is set whenever the surface is served over anything but loopback, and the decision comes from the surface rather than from a constant
  • Sign-out revokes server-side, and a revoked session is refused even if the cookie is replayed
  • Expiry is enforced on the server, not only in the cookie's attributes
Validation
cargo test --workspace --all-featuresbash test/run.sh
Evidence required
cookie_attributesrevocation_provedkey_from_environment
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
apps/majordomus-cli/src/identityapps/majordomus-cli/src/httpapps/majordomus-cli/tests
Not
A session store shared between deploymentsRemembering anything about the reader between sessions
Depends on
I1203
Priority
p0
Profile
implementation
Parallel safe
false
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-08
Updated
2026-09-08
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.