# Design the production browser and session boundary

Type: grilling
Status: open

## Question

What same-origin/CSRF, proxy/TLS, security-header, session lifetime,
revocation, secret rotation, and request-timeout contract should the initial
org-admin web surface enforce, and which parts require server-side session state
rather than the current seven-day stateless cookie?