codingetandClaude 73c4b169c5 fix(auth): invalidate session server-side on logout, not just the cookie ...

/auth/logout previously only cleared the client's cookie, leaving the
session token valid in the sessions table — a stolen cookie captured
before logout would still work afterwards. Add BackendDbInterface#deleteSession
(implemented in SqliteInterface) and call it from the logout route using
the session token from the cookie. Caught by the new auth-http.test.ts
integration test, updated to assert the session is actually invalidated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-02 01:43:50 +00:00

src

fix(auth): invalidate session server-side on logout, not just the cookie

2026-07-02 01:43:50 +00:00

test

fix(auth): invalidate session server-side on logout, not just the cookie

2026-07-02 01:43:50 +00:00

.gitignore

feat: initial commit

2026-06-29 23:07:14 +00:00

package-lock.json

feat: initial commit

2026-06-29 23:07:14 +00:00

package.json

fix(tests): address review gaps in test suite

2026-07-02 01:38:21 +00:00

tsconfig.json

feat: initial commit

2026-06-29 23:07:14 +00:00

tsconfig.test.json

fix(tests): address review gaps in test suite

2026-07-02 01:38:21 +00:00

webpack.config.ts

feat: initial commit

2026-06-29 23:07:14 +00:00

S

Description

No description provided

472 KiB

Languages

TypeScript 99.8%

JavaScript 0.2%