forked from EduCraft/curriculum-project-hub
15 lines
608 B
Markdown
15 lines
608 B
Markdown
# Design the production browser and session boundary
|
|
|
|
Type: grilling
|
|
Status: open
|
|
|
|
## Question
|
|
|
|
What same-origin/CSRF, proxy/TLS, security-header, session lifetime,
|
|
revocation, secret rotation, and request-timeout contract should the initial
|
|
org-admin web surface enforce, and which parts require server-side session state
|
|
rather than the current seven-day stateless cookie? Apply the same browser
|
|
boundary to ADR-0023's separate server-side Platform Session while preserving
|
|
its distinct cookie/token namespace, immediate revocation, per-request grant
|
|
reload, and bounded recent-authentication requirement.
|