Skip to content

fix: evict API-host cookie jar on credential-scope change - #188

Merged
bluejeans117 merged 2 commits into
mainfrom
chore/trust-community-and-cookie-jar
Sep 21, 2026
Merged

bluejeans117 merged 2 commits into
mainfrom
chore/trust-community-and-cookie-jar

Conversation

@bluejeans117

Copy link
Copy Markdown
Collaborator

Summary

  • Changing API Client credential storage between session, remember, and never now clears the documentation session's API-host cookie jar and drops the current request's session-jar selection. The clear is a same-origin DELETE with only the execution marker. The scope change stays in place if the clear fails, and the warning contains no cookie values. Fixes fix: client/credential-scope: evict API-host cookie jar on scope changes #179.
  • docs/releases/3.3.1.md no longer calls a published release unreleased. The 3.4.0 sequencing note is past tense because that publication window is closed.
  • Add Contributor Covenant 2.1, issue forms, and a pull request template. Vulnerability reports stay on the private advisory path.

The renderer assets are rebuilt because this changes canonical client source.

Test plan

  • Credential-scope tests: one marker-only clear when cookies are advertised, no clear without a capability or endpoint, jar selection removed, failed clear keeps the new scope and shows a non-secret warning
  • Existing ApiClient tests pass
  • Release-doc version claims match the published 3.4.0 baseline
  • Adapter renderer assets match the standalone build
  • CI matrix on this pull request

The host cookie jar holds third-party session cookies for the documentation
user. Changing credential storage between session, remember, and never now
clears that jar and drops the current request's session-jar selection, so
browser persistence policy and server-side session state do not drift apart.

The clear is a same-origin DELETE carrying only the execution marker. It
does not include target URLs, request auth, or bodies, and the response is
not read because it can list cookie names. The scope change itself stays
local if the clear fails, and the warning names the uncertainty without
cookie values.

Closes #179.

Signed-off-by: Vishnu R <vishnurajesh45@gmail.com>
An evaluator checking the repository landing page found no conduct policy,
no issue forms, and a release note that still called a published maintenance
release unreleased. The 3.4.0 sequencing paragraph had the same tense: it
described a publication window that has already closed.

The conduct policy is Contributor Covenant 2.1. Issue forms keep
vulnerability reports on the private advisory path. The 3.3.1 note now
states that Java 0.9.0 and ASP.NET Core 0.6.0 published with that release.

Signed-off-by: Vishnu R <vishnurajesh45@gmail.com>
@bluejeans117
bluejeans117 force-pushed the chore/trust-community-and-cookie-jar branch from 29cea26 to 1a01e05 Compare September 21, 2026 17:41
@bluejeans117
bluejeans117 merged commit c057ea7 into main Sep 21, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix: client/credential-scope: evict API-host cookie jar on scope changes

1 participant