Harden live-session security: returnUrl, WS origin, reconnect race, session cap - #34

Merged

pal-tamas merged 10 commits into

mainfrom

security/live-session-hardening

Jun 10, 2026

Commits on Jun 9, 2026

Harden live-session security: returnUrl, WS origin, reconnect race, session cap
pal-tamas
committed
47b6cf0
Harden live-session endpoints: no-store shell, upload/download authz, re-auth on dispatch, returnUrl parity
pal-tamas
committed
aceee4f
Fix generator build-breakers: escape keyword identifiers, dedup partial route registrations
pal-tamas
committed
9d4ac14
Harden WS transport: cap inbound frame size (DoS), CSPRNG for tickets/session ids
pal-tamas
committed
0dbdf31
Fix WASM disposal leaks: unsubscribe user-provider on dispose, bound download sink
pal-tamas
committed
d0ed693
Harden scaffolded template auth defaults: secure cookie, HTTPS/HSTS, UseAuthorization
pal-tamas
committed
46afa37
Low-batch Core fixes: Context.Has reactivity, handler-nav leak, drain race
pal-tamas
committed
c8d021e
Low-batch: URL-encode generator query keys, fail-fast JWT sample dev key
pal-tamas
committed
cbe1f5e

Commits on Jun 10, 2026