jwinterm 223aa75871 security: move session token to handshake auth and rotate on resume ...

The anonymous session token is a bearer credential that was sent in the
Socket.IO handshake query string, where it leaks into proxy/access/referer
logs and is easily observed. Anyone holding it becomes that user (credits,
payout address, pending payments).

- Client now sends the token in the handshake `auth` payload instead of the
  query string. Server reads `auth` first and falls back to the query string
  for backward compatibility during rollout.
- The token is rotated on every successful resume, so a leaked/observed
  token is invalidated the next time the legitimate owner reconnects. The
  client already persists the token returned in `session_resumed`.

Adds a security test asserting resume returns a new token and the old token
no longer resumes. Full suite: 12 suites / 116 tests.

2026-05-31 09:29:20 -04:00

..

DEPLOY.md

feat: initial batch payout logic and output splitting script added

2026-02-18 07:30:46 -05:00

INTEGRATION.md

fix stale smirk and amount bug

2026-03-01 13:56:35 -05:00

LOGS_AND_BACKUP.md

feat: admin dashboard, alert service, and docs reorganization

2026-01-31 20:21:28 -05:00

REMEDIATION_PLAN.md

security: move session token to handshake auth and rotate on resume

2026-05-31 09:29:20 -04:00

TODO.md

add smirk payments and leaderboard and diff tuning

2026-02-20 13:54:36 -05:00