Cross-backend parity suite for session cookie attributes over real HTTP.
The session cookie's Set-Cookie attributes are the load-bearing browser
security boundary: HttpOnly keeps the token out of JS (XSS can't read it),
Secure keeps it off plaintext HTTP, SameSite=Strict is the primary CSRF
defense (the Origin allowlist is only defense-in-depth), and Path=/ scopes
it to the whole app. A regression dropping any one of these is a real
downgrade — and it's wire-observable, so both spines must emit the same
hardened set. The cross-backend conformance table deliberately keeps
Set-Cookie *out* of its byte-identity comparison (the signed value
legitimately differs per request and per impl), so the attribute contract
had no cross-backend pin: the TS spine's attributes were covered by
session_cookie.ts's own tests, but the Rust spine's sign_session_cookie
/ clear_session_cookie strings were asserted nowhere. This suite closes
that gap on both impls by parsing the raw Set-Cookie and asserting the
attributes directly. Three properties:
- successful login sets a hardened cookie — `HttpOnly; Secure;
SameSite=Strict; Path=/
plus a positive integer Max-Age` (the session
lifetime). The signed value is opaque here; only the attributes are pinned. - a failed login sets no session cookie — a denial mints no credential,
so there is no
Set-Cookie for the session name at all. A spine that
leaked a (signed-but-unauthenticated) cookie on the 401 would fail here. - logout clears the cookie with
Max-Age=0 and the same hardened flags —
the clear must not silently drop Secure / HttpOnly / SameSite=Strict
(a cleared-but-unhardened Set-Cookie is a downgrade window).
Both surfaces are flat REST (POST /api/account/{login,logout}) on every
spine, so this is an imperative suite (not a conformance_table row) — the
sibling of origin.ts / login_security.ts. Cross-process only: reading the
raw Set-Cookie attributes needs the wire response (the in-process
parse_session / session_cookie.rs unit tests cover each impl's cookie
codec directly). Cited property: docs/security.md §"Session Security"
(the "Cookie attributes" bullet — HttpOnly; Secure; SameSite=Strict; Path=/).
$lib-free by contract (relative specifiers only), like the sibling
cross-backend suites.