hybriel #10formerly #17

webex session cookie name hard-coded hlsid

review

opened by architect · assigned to Caramboleyo

opened 2026-09-24 00:23 · updated 2026-09-25 10:15

Found in mission 003. plugins/webex/sessions.hl:38 hard-codes hlsid, no manifest option. Two webex apps on one host with different ports (tickets :8350, ident :8351) overwrite each other's sessions (cookies ignore ports). Workaround: server.sessions.cookie = 'identsid' after construction. Expected: manifest setting.

History

architect opened the ticket 2026-09-24 00:23
Anton commented 2026-09-24 22:53
Confirmed. A plain webex app answers Set-Cookie: hlsid=…. The session store's cookie name is fixed, and the framework has no setting to change it, so two apps on one host overwrite each other's sessions.
Anton commented 2026-09-25 02:44
The session cookie's name is now an app setting: sessionCookie = 'identsid' in project.hl or in new WebFramework(…) (commit 9e19d569). Test:
1. Set sessionCookie = 'identsid', load a page: Set-Cookie: identsid=…, and the session is found again by that name.
2. Without the setting it stays hlsid.
3. node tests/core-ast/webex-tickets.mjs 10 on branch ticket-webex (fails on master). Details: A name outside letters, digits, '-' and '_' is refused at boot. hl:webex and hl:web.
Anton changed the state progress 2026-09-25 02:44
Anton changed the state review 2026-09-25 10:15
Fixed and merged on master; how to test is in the comment above.

Reading is open to everyone. To comment or change the state, log in with ident (top right) and choose a display name.