fix: correct session DELETE tautology and HTTP cookie domain interpolation #203

New Issue

MrUnknownDE · 2026-04-05T17:02:28+02:00

MrUnknownDE commented

2026-04-05 17:02:28 +02:00

Originally created by @Abhinav-kodes on 2/25/2026

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Two bugs in server/auth/sessions/resource.ts with minimal, surgical fixes.
Changes are limited to two single-line corrections — no architecture changes, no new abstractions.

Closes #2534

Fix 1 — Session DELETE tautology

validateResourceSessionToken was deleting all rows in resourceSessions on any expiry because the WHERE clause compared the column to itself:

// Before — tautology, deletes everything
.where(eq(resourceSessions.sessionId, resourceSessions.sessionId)

// After — targets only the expired session
.where(eq(resourceSessions.sessionId, sessionId)

serializeResourceSessionCookie had a missing { in the HTTP path:

// Before — sends literal string "$domain}" to browser
`... Domain=$domain}`

// After — correctly interpolates the domain variable
`... Domain=${domain}`

Testing

Verified expired session only deletes itself, not others
Verified HTTP resource cookie is correctly scoped to domain

*Originally created by @Abhinav-kodes on 2/25/2026* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Two bugs in `server/auth/sessions/resource.ts` with minimal, surgical fixes. Changes are limited to two single-line corrections — no architecture changes, no new abstractions. Closes #2534 ## Fix 1 — Session DELETE tautology `validateResourceSessionToken` was deleting all rows in `resourceSessions` on any expiry because the WHERE clause compared the column to itself: ```ts // Before — tautology, deletes everything .where(eq(resourceSessions.sessionId, resourceSessions.sessionId) // After — targets only the expired session .where(eq(resourceSessions.sessionId, sessionId) ``` ## Fix 2 — HTTP cookie Domain broken template literal `serializeResourceSessionCookie` had a missing `{` in the HTTP path: ```ts // Before — sends literal string "$domain}" to browser `... Domain=$domain}` // After — correctly interpolates the domain variable `... Domain=${domain}` ``` ## Testing - [x] Verified expired session only deletes itself, not others - [x] Verified HTTP resource cookie is correctly scoped to domain

MrUnknownDE closed this issue

2026-04-05 17:02:28 +02:00

MrUnknownDE referenced this issue

2026-04-05 19:37:46 +02:00

Unable to send invitation email to user #1623

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#203