Auth / foldkit-auth
Refusals
| Request | Answer |
|---|---|
| No session cookie | a visitor |
A cookie, from a request without a trusted Origin (and, for 'scripted', the CSRF header) | 401, The request did not show it came from this application. |
| A cookie that no longer verifies (signed out, expired, idle, revoked) | 401, Your session ended. |
| Two session cookies | 401, Sign in again. |
x-foldkit-subject naming someone other than the session | 401, Who is signed in changed. (SUBJECT_CHANGED) |
| A session store that fails | a defect (500), never a visitor |
A page served with Referrer-Policy: no-referrer sends Origin: null on its
own posts; such a request counts as the application's when its
Sec-Fetch-Site, which no page can set, says same-origin.
A long-lived connection re-checks the cookie it opened with. revalidate
asks again of the request a live stream or socket opened with, and Yielded's
renewal rotates the session's credential, so after the page renews, that
stream or socket ends refused (Your session ended., a 4401) though the
session lives. The client opens it again with the new cookie; the first
refusal of a fresh request is the one that means signed out.
Remote's calls do not keep a session alive. The resolver verifies with
verifySession, which renews nothing. A stateful session with an
idleTimeout ends that long after its last renewal however busy Remote is,
and every call then answers Your session ended. Renew through Yielded's
session renew operation (renewSession) while the reader is active, or
choose an idle timeout that fits.
The x-foldkit-subject header (SUBJECT_HEADER, from foldkit-auth, which
imports nothing of Yielded's and so suits a browser bundle) carries no
secret: visitor or subject:<key>, what Me already shows the client. A
client that sends none is answered as whoever the session says. Without
key the resolver compares it with the session's subjectId, for a client
that writes the header itself; AuthServer.answered needs key.
Limits
- MCP agents send a bearer credential, which no resolver here reads yet. A
Sync replica reconnects after a 4401, refused at each upgrade, since a
browser's
WebSocketdoes not say why an upgrade failed. - Cookie sessions only; a bearer credential is not read.
- A session cookie with a
domaintrusts every subdomain, as Yielded documents: one that sets its own cookie of the same name makes every requestSign in again.until it is cleared.