The session door holds no verifier
Table of Contents
This page is a capture in the inbox bucket of the product backlog — a pre-sprint idea, not yet pulled into a sprint as a story.
1. What
The application builds the session door with server.verifier() before the service
runner installs the verifier, so the door keeps an empty one for the life of the
process. Every sign-in refuses itself with Authentication is not configured, and
a browser can therefore never hold a session. The startup log shows the two facts
beside each other: Fetched JWKS public key from IAM and JWT authenticator
configured with RS256 verifier, and then, on the first sign-in, no verifier is
configured.
2. Why
The change stream has one client, a browser, and a browser reaches it through a session. Until this is fixed the stream can be tested in pieces and not as a deployment, so the defect blocks the acceptance of the streaming story as well as every screen behind the door.
3. References
- The work under way: Let the door reach the verifier.
projects/ores.http/server/src/app/application.cpp, where the door is built.projects/ores.http/api/include/ores.http.api/net/http_server.hpp, where the verifier is installed.