sergehuber opened a new pull request, #851: URL: https://github.com/apache/unomi/pull/851
/context.json and /eventcollector accept a profile id in the request body and a session id with the request. For a public caller these are now treated as claims to be checked rather than as instructions: the body profileId is honoured only when it matches the caller's own context-profile-id cookie, and a supplied session is continued only when that cookie already owns it. The cookie is the single source of truth for who a public caller is. A session that is not continued is detached rather than rebound, and its id is not echoed back in the response - a client that saw its own id returned would keep replaying an id the server has not accepted. Anonymous browsing, personas and profile overrides are unchanged. A caller with no cookie is still issued a profile, which is how tracking has always worked. The server-side path is preserved: a caller holding the tenant private key still sets the body profileId, gated on hasSystemAccess() behind isTrustedProfileCaller() so the distinction has one seam rather than being spread across the call sites. The shipped profile cookie now defaults to HttpOnly. The model above rests on that cookie not being readable from page script, so the default is part of the design rather than a preference. ContextEndpointBaselineIT records the behaviour on both sides of the change: its compat_* tests must pass either way, and its hardened_* tests pin the new guarantees. The nine binding tests in ContextServletIT pin what must not change. Jira: https://issues.apache.org/jira/browse/UNOMI-975 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
