fix: session-cookie requests partition the response cache without a bearer - #844
Conversation
…earer Merging #772 (distributed cache) with #788 (opaque admin sessions) left a gap: _cache_partition required a bearer header, so every state-changing admin POST from a cookie-authenticated operator failed with 401 before any handler logic ran. An active opaque session id now derives the partition (random per login, so cross-session reuse stays impossible), and a regression test locks the flow in.
|
Warning Review limit reachedNext included review available in 57 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| raw = self.headers.get("authorization", "") | ||
| token = raw.split(" ", 1)[1].strip() if raw.lower().startswith("bearer ") else "" | ||
| if not token: # pragma: no cover - _authorize rejects this first | ||
| if not token: | ||
| session_id = security._extract_admin_session_cookie(self.headers) | ||
| if session_id and security._admin_session_is_active(session_id): | ||
| return hashlib.sha256(f"admin-session:{session_id}".encode("utf-8")).hexdigest() | ||
| raise RequestError(401, "unauthorized", "bearer token is required") | ||
| return hashlib.sha256(token.encode("utf-8")).hexdigest() |
There was a problem hiding this comment.
📝 Info: Bearer/session priority differs between authorize and partitioner
authorize checks an active admin session before the bearer header (server.py:281), but _cache_partition checks the bearer first and only falls back to the session. A request carrying both is authorized by session yet partitioned by bearer hash. Harmless today since the partition is only an isolation key, but the ordering diverges.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Merge-gate evidence (2026-08-25): Fixes a live main regression — merging #772 with #788 broke every state-changing admin POST for cookie-authenticated operators (401 from the cache partitioner before handler logic). Full local suite green (1807 tests) including the new two-session regression test. Hosted checks are queued behind an exhausted shared runner pool; merging on complete local evidence because the bug degrades production behavior on current main. |
1 participant
Summary
Integration regression from landing #772 (distributed response cache) and #788 (opaque admin sessions) on the same main:
_cache_partitionrequired a bearer header, so every state-changing admin POST (/api/v1/evaluation_runs,/admin/simulate, agent-pool writes) from a cookie-authenticated operator failed with 401 before reaching handler logic.Fix
admin-session:); session ids are random per login, so cross-session cache reuse stays impossible.Full local suite green (1807 tests).