curriculum-project-hub/.scratch/saas-production-readiness/issues/20-design-production-web-session-boundary.md

Design the production browser and session boundary

Type: grilling Status: open

Question

What same-origin/CSRF, proxy/TLS, security-header, session lifetime, revocation, secret rotation, and request-timeout contract should the initial org-admin web surface enforce, and which parts require server-side session state rather than the current seven-day stateless cookie? Apply the same browser boundary to ADR-0023's separate server-side Platform Session while preserving its distinct cookie/token namespace, immediate revocation, per-request grant reload, and bounded recent-authentication requirement.