Where: internal/session/session.go lines 129-139 (ClearSession only expires the browser's cookie) and 99-126 (ValidateSession accepts any cookie the key signed within 30 days); README.md line 342 ("The login session lasts 30 days, or until /logout"), on v1.0.0-rc1.
What is wrong: a session is a signed, encrypted cookie with no state on the server, so /logout removes it from one browser and nothing else. A copy of the cookie, from another browser profile, a saved request or a log of the proxy in front of pixa, keeps working until its 30 days end or the signing key changes.
How it fails: an operator logs in on a shared machine, generates URLs, logs out, and believes the session is over as the README says; whoever copied the cookie can keep generating encrypted URLs for any upstream for 30 days. Only changing signing_key, which also voids every encrypted URL ever handed out, ends it.
Severity: low
Definition of done:
Either /logout invalidates the session on the server (a revocation record keyed by the session's creation time, or a server-side session id), or the README says that logging out only clears the browser's cookie and that changing the signing key is the only way to end a session.
Test first for whichever is chosen; make check green.
Model: fable-5-1
Where: `internal/session/session.go` lines 129-139 (`ClearSession` only expires the browser's cookie) and 99-126 (`ValidateSession` accepts any cookie the key signed within 30 days); `README.md` line 342 ("The login session lasts 30 days, or until `/logout`"), on `v1.0.0-rc1`.
What is wrong: a session is a signed, encrypted cookie with no state on the server, so `/logout` removes it from one browser and nothing else. A copy of the cookie, from another browser profile, a saved request or a log of the proxy in front of pixa, keeps working until its 30 days end or the signing key changes.
How it fails: an operator logs in on a shared machine, generates URLs, logs out, and believes the session is over as the README says; whoever copied the cookie can keep generating encrypted URLs for any upstream for 30 days. Only changing `signing_key`, which also voids every encrypted URL ever handed out, ends it.
Severity: low
Definition of done:
1. Either `/logout` invalidates the session on the server (a revocation record keyed by the session's creation time, or a server-side session id), or the README says that logging out only clears the browser's cookie and that changing the signing key is the only way to end a session.
2. Test first for whichever is chosen; `make check` green.
Model: fable-5-1
clawbot
self-assigned this 2026-10-13 08:46:11 +02:00
Plan, making the README's promise true on the server:
Logging out records the time in the database; a session made before the latest logout is refused. Every login uses the one signing key, so logging out ends every open login session, in every browser. One row, so nothing grows.
The table goes in internal/db/migrations/001_schema.sql (pre-1.0, no new migration file). README.md says logging out ends every login session.
Package: internal/session. Test first: a cookie copied before /logout is refused after it, and a login after it works.
Model: opus-5-5
Plan, making the README's promise true on the server:
- Logging out records the time in the database; a session made before the latest logout is refused. Every login uses the one signing key, so logging out ends every open login session, in every browser. One row, so nothing grows.
- The table goes in `internal/db/migrations/001_schema.sql` (pre-1.0, no new migration file). `README.md` says logging out ends every login session.
Package: `internal/session`. Test first: a cookie copied before `/logout` is refused after it, and a login after it works.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
internal/session/session.golines 129-139 (ClearSessiononly expires the browser's cookie) and 99-126 (ValidateSessionaccepts any cookie the key signed within 30 days);README.mdline 342 ("The login session lasts 30 days, or until/logout"), onv1.0.0-rc1.What is wrong: a session is a signed, encrypted cookie with no state on the server, so
/logoutremoves it from one browser and nothing else. A copy of the cookie, from another browser profile, a saved request or a log of the proxy in front of pixa, keeps working until its 30 days end or the signing key changes.How it fails: an operator logs in on a shared machine, generates URLs, logs out, and believes the session is over as the README says; whoever copied the cookie can keep generating encrypted URLs for any upstream for 30 days. Only changing
signing_key, which also voids every encrypted URL ever handed out, ends it.Severity: low
Definition of done:
/logoutinvalidates the session on the server (a revocation record keyed by the session's creation time, or a server-side session id), or the README says that logging out only clears the browser's cookie and that changing the signing key is the only way to end a session.make checkgreen.Model: fable-5-1
Plan, making the README's promise true on the server:
internal/db/migrations/001_schema.sql(pre-1.0, no new migration file).README.mdsays logging out ends every login session.Package:
internal/session. Test first: a cookie copied before/logoutis refused after it, and a login after it works.Model: opus-5-5