Fabrika/PersonalBlog
8
0
Fork 1
Code Issues 305 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

[E05-S02-T05] Expiration enforced server-side #240

New Issue
Open
opened 2026-08-27 00:17:20 +00:00 by kpcto · 0 comments
kpcto commented 2026-08-27 00:17:20 +00:00
Owner
Copy Link
Copy Source

Parent story: [E05-S02] Opaque DB-backed session (#73)

Intent

Enforce session expiration on the server side.

Acceptance criteria

  • Session expiration is enforced on the server side
  • An expired session is rejected even if the cookie remains present

Explicitly out of scope

  • Token generation (E05-S02-T01)
  • Lookup hash storage (E05-S02-T02)
  • Secure/HttpOnly/SameSite attributes (E05-S02-T03)
  • Logout revocation (E05-S02-T04)
  • Admin API 401 to anonymous caller (E05-S02-T06)

Test plan

  • Automated test advances the clock and asserts an expired session is rejected

Rollback note

  • Revert expiry change; re-login to obtain a fresh session

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E05-S02] Opaque DB-backed session (#73) ## Intent Enforce session expiration on the server side. ## Acceptance criteria - Session expiration is enforced on the server side - An expired session is rejected even if the cookie remains present ## Explicitly out of scope - Token generation (E05-S02-T01) - Lookup hash storage (E05-S02-T02) - Secure/HttpOnly/SameSite attributes (E05-S02-T03) - Logout revocation (E05-S02-T04) - Admin API 401 to anonymous caller (E05-S02-T06) ## Test plan - Automated test advances the clock and asserts an expired session is rejected ## Rollback note - Revert expiry change; re-login to obtain a fresh session ### Owning stream platform ### Risk quadrant agent-full
kpcto added this to the Sprint 1 milestone 2026-08-27 00:17:20 +00:00
kpcto added the
kind
task
status
proposed
 labels 2026-08-27 00:17:20 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agent/analyst-drafted
agent/analyst-drafted
kind
bug
kind
bug
kind
epic
kind
epic
kind
initiative
EPPP programme initiative
kind
story
kind
story
kind
task
EPPP engineering card/task decomposed from a story
kind
toil
kind
toil
loop
1
loop
1
loop
2
loop
2
loop
3
loop
3
needs/human-decision
needs/human-decision
needs/security-review
needs/security-review
risk
agent-full
risk
agent-full
risk
human-gated
risk
human-gated
risk
human-only
risk
human-only
size
l
size
l
size
m
size
m
size
s
size
s
status
blocked
status
blocked
status
done
Workflow: Done
status
in-progress
status
in-progress
status
proposed
status
proposed
status
ready
status
ready
status
review
status
review
stream
checkout
stream
checkout
stream
onboarding
stream
onboarding
stream
platform
stream
platform
tier/t0
trivial — implementer only, auto-merge
 tier/t1
standard — implementer + reviewer + tester
 tier/t2
complex — security if triggered, human merge
 tier/t3
critical — full chain + security, human merge
No labels
kind
task
status
proposed
Milestone
No items
No Milestone Sprint 1
Projects
Clear projects
No projects
Assignees
Clear assignees
bot-analyst bot-dispatcher bot-implementer bot-migrations bot-reviewer bot-security bot-tester kpcto
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Fabrika/PersonalBlog#240