feat(bff): add stateless cookie session variant with AES-GCM sealing - #118

Merged

cuioss-oliver merged 24 commits into

mainfrom

feature/plan-07a-bff-cookie-crypto-core

Jul 28, 2026

Commits on Jul 28, 2026

refactor(bff): extract a mode-neutral SessionBinding seam

cuioss-oliver
and
claude
committed
feat(bff): add the AES-256-GCM sealed-cookie crypto core

cuioss-oliver
and
claude
committed
feat(bff): add decrypt-only previous_key rotation
cuioss-oliver
committed
feat(bff): add two-mode cookie key material
cuioss-oliver
committed
feat(bff): re-seal cookie sessions on token refresh
cuioss-oliver
committed
feat(bff): gate the back-channel logout endpoint to 404 in cookie mode
cuioss-oliver
committed
test(bff): add in-module cookie-mode boot fixture and generate-on-startup guard
cuioss-oliver
committed
test(bff): add cookie-mode deployment descriptors and the activation wiring guard
cuioss-oliver
committed
test(bff): prove the sealed cookie session across two instances end to end
cuioss-oliver
committed
docs(bff): record the accepted @Nullable record-component layout
cuioss-oliver
committed
style(bff): apply the quality gate's in-place normalizations
cuioss-oliver
committed
fix(bff): drive the pre-route Cookie cap and the seal budget from one config key
cuioss-oliver
committed
chore(simplify): collapse accidental complexity in plan-07a-bff-cookie-crypto-core

cuioss-oliver
and
claude
committed
fix(edge): cap the reserved-path request body (finding 0ced30)
cuioss-oliver
committed
fix(bff): decode out-of-range epoch seconds as no session

cuioss-oliver
and
claude
committed
fix(bff): log the back-channel capability gate at DEBUG, not WARN

cuioss-oliver
and
claude
committed
fix(bff): retain every Set-Cookie value on the response

cuioss-oliver
and
claude
committed
fix(bff): map an unbindable session to a clean 500 callback outcome

cuioss-oliver
and
claude
committed
fix(config): canonicalize oidc.session.mode once, share one predicate

cuioss-oliver
and
claude
committed
fix(edge): retire the connection after a reserved-body 413

cuioss-oliver
and
claude
committed
refactor(bff): use unnamed patterns for unread unseal catch parameters

cuioss-oliver
and
claude
committed
docs(bff): correct cookie-mode statements and bound the rollover INFO

cuioss-oliver
and
claude
committed
test(bff): assert the real key length and clear S5778/S6213 findings

cuioss-oliver
and
claude
committed
style: apply formatter reflow from the quality gate

cuioss-oliver
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(bff): add stateless cookie session variant with AES-GCM sealing - #118

feat(bff): add stateless cookie session variant with AES-GCM sealing#118
cuioss-oliver merged 24 commits into
mainfrom
feature/plan-07a-bff-cookie-crypto-core

Commits on Jul 28, 2026

refactor(bff): extract a mode-neutral SessionBinding seam

feat(bff): add the AES-256-GCM sealed-cookie crypto core

feat(bff): add decrypt-only previous_key rotation

feat(bff): add two-mode cookie key material

feat(bff): re-seal cookie sessions on token refresh

feat(bff): gate the back-channel logout endpoint to 404 in cookie mode

test(bff): add in-module cookie-mode boot fixture and generate-on-startup guard

test(bff): add cookie-mode deployment descriptors and the activation wiring guard

test(bff): prove the sealed cookie session across two instances end to end

docs(bff): record the accepted @Nullable record-component layout

style(bff): apply the quality gate's in-place normalizations

fix(bff): drive the pre-route Cookie cap and the seal budget from one config key

chore(simplify): collapse accidental complexity in plan-07a-bff-cookie-crypto-core

fix(edge): cap the reserved-path request body (finding 0ced30)

fix(bff): decode out-of-range epoch seconds as no session

fix(bff): log the back-channel capability gate at DEBUG, not WARN

fix(bff): retain every Set-Cookie value on the response

fix(bff): map an unbindable session to a clean 500 callback outcome

fix(config): canonicalize oidc.session.mode once, share one predicate

fix(edge): retire the connection after a reserved-body 413

refactor(bff): use unnamed patterns for unread unseal catch parameters

docs(bff): correct cookie-mode statements and bound the rollover INFO

test(bff): assert the real key length and clear S5778/S6213 findings

style: apply formatter reflow from the quality gate