Late feature-denial probe uses revoked cross-User sessions #1525

Open
opened 2026-10-09 09:12:01 +00:00 by kayg · 0 comments
Owner

The full #1500 adversarial campaign's defensive unknown/missing feature-flag checks expect 403 for Users B, C and D but receive 401 after earlier session-revocation and User-purge work. All six requests are denied and the unknown/missing status pairs agree.

A fresh production 9dc65437e comparison passes with zero findings and zero SLOW results:
ADVERSARIAL_SKIP_WEB_BUILD=1 ADVERSARIAL_FOCUSED_ROUND2_ONLY=1 ROUND2_SECTIONS=security-origin-licence tests/adversarial/run.sh.

The separate four-User matrix also passes all 1,058 identity comparisons and 127 ownership checks. Keep the existing assertions. Restore live standard-session fixtures before this late full-round phase, or explicitly test the revoked-session state before the feature authorization state. Evidence: merge35c security-origin-production.log and adversarial.log.

The full #1500 adversarial campaign's defensive unknown/missing feature-flag checks expect 403 for Users B, C and D but receive 401 after earlier session-revocation and User-purge work. All six requests are denied and the unknown/missing status pairs agree. A fresh production 9dc65437e comparison passes with zero findings and zero SLOW results: `ADVERSARIAL_SKIP_WEB_BUILD=1 ADVERSARIAL_FOCUSED_ROUND2_ONLY=1 ROUND2_SECTIONS=security-origin-licence tests/adversarial/run.sh`. The separate four-User matrix also passes all 1,058 identity comparisons and 127 ownership checks. Keep the existing assertions. Restore live standard-session fixtures before this late full-round phase, or explicitly test the revoked-session state before the feature authorization state. Evidence: merge35c security-origin-production.log and adversarial.log.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1525
No description provided.