3.3 KiB
Phase 7.1: Security — Session Revocation on Privilege Change - Discussion Log
Audit trail only. Do not use as input to planning, research, or execution agents. Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
Date: 2026-06-05 Phase: 07.1-security-session-revocation-on-privilege-change Areas discussed: Current-session behavior, Scope (CR-01..03), API response + frontend UX
Current-Session Behavior
| Option | Description | Selected |
|---|---|---|
| Revoke all, including current | Cleanest security posture — matches GitHub, Google. Attacker cut off immediately. User must re-login within 15 min (access token TTL). | |
| Exclude current session | Revoke all OTHER sessions, keep the current one alive. More user-friendly; requires reading and hashing the current refresh cookie to exclude it. | ✓ |
User's choice: Exclude current session Notes: No follow-up needed — clear preference.
Implementation mechanism
| Option | Description | Selected |
|---|---|---|
| Read raw cookie, hash it, match to DB | Read refresh_token cookie, compute SHA-256, pass as skip_token_hash to revoke_all_refresh_tokens. Consistent with how rotate_refresh_token already works. |
✓ |
| Pass DB row ID | Look up the RefreshToken row during the request, pass its UUID to exclude. More explicit but needs a new helper. | |
| You decide | Let the planner choose the cleanest approach. |
User's choice: Read raw cookie, hash it, match to DB
Scope: CR-01..03
| Option | Description | Selected |
|---|---|---|
| Only CR-01..03 | Three missing revoke_all_refresh_tokens() calls. Each ~2 lines. Fast, contained blast radius. Other issues deferred to 7.2–7.4. |
✓ |
| CR-01..03 + JTI revocation | Also add JTI claims + Redis-based access-token revocation. Much larger change. | |
| All CONCERNS.md issues | CR-01..03 + JTI + ES256 + token fingerprinting. Major auth rewrite, 3–4 plans. |
User's choice: "I want to focus now on CR-01..03 but I want you to add a 7.2-4 for the other three concerns right now." Notes: Phases 7.2 (JTI), 7.3 (ES256), 7.4 (token fingerprinting) added to ROADMAP.md as part of this session.
API Response + Frontend UX
Response shape
| Option | Description | Selected |
|---|---|---|
Add sessions_revoked count |
Return {"message": "...", "sessions_revoked": N}. Minimal change, useful signal for frontend. |
✓ |
| Silent revocation | Don't change response shape. Revocation happens transparently. |
User's choice: Add sessions_revoked count
Frontend handling
| Option | Description | Selected |
|---|---|---|
| Show toast notification | "Other sessions have been terminated." — shown briefly when sessions_revoked > 0. |
✓ |
| No frontend change | Ignore sessions_revoked in response. Backend-only phase. |
User's choice: Show toast notification
Claude's Discretion
None — all areas were resolved with explicit user preferences.
Deferred Ideas
- Phase 7.2: JTI claim + Redis access-token revocation (closes 15-min grace window)
- Phase 7.3: ES256 algorithm upgrade (HS256 → ECDSA P-256)
- Phase 7.4: Token fingerprinting /
fgpclaim + validation