curriculum-project-hub/.scratch/saas-production-readiness/issues/20-design-production-web-session-boundary.md

Design the production browser and session boundary

Type: grilling Status: open

Question

What same-origin/CSRF, proxy/TLS, security-header, session lifetime, revocation, secret rotation, and request-timeout contract should the initial org-admin web surface enforce, and which parts require server-side session state rather than the current seven-day stateless cookie?