Documentation
¶
Overview ¶
Package sessionbinding binds sessions to the validated issuer and subject, never to a bearer token. Authentication must run before ownership enforcement.
Index ¶
- Constants
- Variables
- func AddOwnedSession(ctx context.Context, manager Store, sess session.Session) error
- func BindOwner(ctx context.Context, sess session.Session) error
- func Check(r *http.Request, id string, lookup Lookup) error
- func Format(iss, sub string) (string, error)
- func FromIdentity(identity *auth.Identity) (string, error)
- func NewMiddleware(extract func(*http.Request) (string, error), lookup Lookup, ...) (func(http.Handler) http.Handler, error)
- func Parse(value string) (iss, sub string, ok bool)
- func RequestID(r *http.Request, queryKey string) (string, error)
- func Validate(stored string, identity *auth.Identity) error
- func WriteOwnershipError(w http.ResponseWriter, requestID any, err error)
- type Lookup
- type Store
Constants ¶
const MetadataKey = session.MetadataKeyIdentityBinding
MetadataKey is shared with persisted vMCP sessions for compatibility.
const UnauthenticatedSentinel = "unauthenticated"
UnauthenticatedSentinel is reserved for an actually absent identity.
Variables ¶
var ( // ErrInvalidBinding denotes malformed issuer/subject claims. ErrInvalidBinding = errors.New("invalid identity binding") // ErrNotFound deliberately conceals missing, unowned and foreign sessions. ErrNotFound = session.ErrSessionNotFound )
Functions ¶
func AddOwnedSession ¶
AddOwnedSession binds an ordinary proxy session before atomic publication. sess must be newly constructed and unpublished; its metadata is modified. A collision may reuse only the same owner's record, never replace metadata. Shared storage does not provide cross-replica live-stream delivery.
func Check ¶
Check validates a session-bearing request using its authenticated context. Empty IDs are sessionless; callers enforce any protocol-required ID separately.
func FromIdentity ¶
FromIdentity accepts nil only for auth-disabled deployments. A synthetic anonymous/local identity with valid claims binds normally; malformed non-nil identities must never downgrade to the unauthenticated sentinel.
func NewMiddleware ¶
func NewMiddleware(extract func(*http.Request) (string, error), lookup Lookup, reject func(http.ResponseWriter, *http.Request, error)) (func(http.Handler) http.Handler, error)
NewMiddleware constructs ownership enforcement. extract must classify requests without consuming their bodies and return an empty ID only for truly sessionless requests. reject must conceal ErrNotFound (404) and map storage failures to 503. Install inside authentication and outside stateful handlers/restoration.
func RequestID ¶
RequestID reads protocol session carriers, rejecting duplicate or conflicting values before a backend can interpret them differently. queryKey may be empty.
func Validate ¶
Validate fails closed for legacy records without an owner. Refreshed tokens for the same issuer and subject are accepted. It never mutates session state.
func WriteOwnershipError ¶
func WriteOwnershipError(w http.ResponseWriter, requestID any, err error)
WriteOwnershipError uses the ordinary proxies' non-disclosing JSON-RPC 404.
Source Files