Repository navigation
Terminal session: a cookie the system deletes is no longer sent - #8
Merged
Merged
Conversation
A Set-Cookie with Max-Age=0 or an Expires in the past - how a system ends a session or drops a logon ticket - was stored in the jar like any other cookie, so the ended session (or the old ticket) went out again on every later request. It is dropped now, as a browser drops it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The terminal renderer's session (
renderers/terminal/session.mjs) stored everySet-Cookiein its jar, including the ones a system sends to delete a cookie:Max-Age=0or anExpiresdate in the past, as on a logoff or a session end. The ended session cookie, or the old logon ticket, then went out again on every later request. Those cookies are now dropped from the jar, the way a browser drops them.Max-Agetakes precedence overExpires, as RFC 6265 says. (The mcp-server client's jar already handles this. Itssystem.test.mjscovers the same case.)test/terminal.test.mjs: a session cookie deleted with anExpiresin the past, then a--cookieticket deleted withMax-Age=0. It fails without the fix.npm testpasses locally (exit 0).Security pass over the rest of the repository (round 5). The mock's static server already refuses path traversal (
startsWith(root + sep)) and binds to 127.0.0.1.ci.ymlis read-only (contents: read,persist-credentials: false), and no${{ }}expression reaches arun:block. The renderers have no HTML sinks.🤖 Generated with Claude Code
https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
Generated by Claude Code