0 Releases 36 Tags

RSS Feed

• v0.27.0 7314895ec4

  Compare

  fix(auth): stateless session cookie — stop logging users out on deploy (ADR-029)

  mathias released this 2026-06-11 21:07:13 +00:00 | 24 commits to main since this release

  Pilot feedback: lots of re-logging-in on iPhone. Three causes: sessions lived in
  an in-memory map (wiped on every pod restart/deploy), a 1h TTL (idle >1h forced
  re-login on a check-back-tomorrow reader), and a session cookie with no Max-Age
  (dropped on Safari close). Each re-login is the full IdP redirect dance.

  Make sessions stateless: identity + absolute expiry live inside the existing
  HMAC-signed cookie (no server table), TTL 1h → 30 days sliding, cookie now
  persistent (Max-Age). Survives restarts (test: a cookie from one instance is
  accepted by a fresh instance with the same secret), browser-close, and idle.
  Trade: no server-side revocation — logout clears the cookie client-side; rotating
  tapir-session-secret is the global logout lever. Accepted for the Stage-0 reader.

  Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)