forked from bai/curriculum-project-hub
12 lines
375 B
Markdown
12 lines
375 B
Markdown
# Design the production browser and session boundary
|
|
|
|
Type: grilling
|
|
Status: open
|
|
|
|
## Question
|
|
|
|
What same-origin/CSRF, proxy/TLS, security-header, session lifetime,
|
|
revocation, secret rotation, and request-timeout contract should the initial
|
|
org-admin web surface enforce, and which parts require server-side session state
|
|
rather than the current seven-day stateless cookie?
|