nx_http_session.nx
buildroot/runtime/nx_http_session.nx
about
nx_http_session.nx -- session-token format + Set-Cookie/Cookie I/O.
Per cardinal feedback-privacy-by-default-no-tracking:
- Session tokens are OPAQUE. Server-side state (caller's
responsibility, via future nx_kv_store) maps token -> data.
The cookie carries ONLY the random ID; no encoded user info.
- Sessions are EPHEMERAL. Default Max-Age = 30 min (1800s).
Caller picks longer/shorter; the substrate's default tilts
short.
- Default flags: HttpOnly + Secure + SameSite=Strict. Together
they prevent: JS cookie theft (XSS escalation), HTTP-only
leakage, CSRF token replay.
Per cardinal feedback-no-third-party-trust-native-or-nothing:
substrate's own session layer; no JWT library, no
express-session, no PHP $_SESSION. Substrate produces 32 hex
chars; future nx_kv_store maps them to server-side records.
Token format: 32 chars lowercase hex = 16 random bytes from
caller's CSPRNG. 128 bits of entropy. RFC 7616 ยง3.4.1
guidance: 64+ bits adequate; we use 128 for headroom.
nx_capability_claims:
needs: [sealed_enum, byte_ops, caller_supplied_random]
provides: [session_token_format, set_cookie_emit,
cookie_header_parse, secure_default_flags]
safety: [no_unchecked_deref, no_floating_point, no_syscall,
opaque_token_no_pii, ephemeral_default]
verdict: [sealed_enum_5_state]
license: ORIGINAL
kind: racing_crew_specialist
layer: L3 (algorithm: session token + cookie I/O)
dependencies 0 imports · 2 importers
imports: none
imported by: nx_admin_login_flow.nxnx_http_session_test.nx
structs
| none |
consts
| 36 | const NXSS_OK: i64 = 0 |
| 37 | const NXSS_OOM_BUFFER: i64 = 1 |
| 38 | const NXSS_BAD_TOKEN: i64 = 2 |
| 39 | const NXSS_NOT_FOUND: i64 = 3 |
| 40 | const NXSS_BAD_ARG: i64 = 4 |
| 41 | const NXSS_VERDICT_N: i64 = 5 |
| 60 | const NXSS_TOKEN_BYTES: i64 = 16 // 128-bit entropy |
| 61 | const NXSS_TOKEN_HEX_LEN: i64 = 32 // 32 hex chars |
| 66 | const NXSS_DEFAULT_MAX_AGE_S: i64 = 1800 |
functions
| 43 | func nxss_verdict_is_valid(v: i64) -> i64 called by 1: main |
| 49 | func nxss_verdict_name(v: i64) -> *u8 called by 1: main |
| 72 | func nxss_emit_hex(src: *u8, src_n: i64, called by 1: nx_http_session_token_from_bytes |
| 93 | func nxss_is_hex_lower(b: i64) -> i64 |
| 100 | func nxss_validate_token_hex(buf: *u8, n: i64) -> i64 called by 3: nx_alogin_validate_sessionnx_http_session_emit_set_cookiemain calls 1: nxss_is_hex_lower |
| 117 | func nx_http_session_token_from_bytes( |
| 147 | func nx_http_session_emit_set_cookie( |
| 237 | func nx_http_session_emit_set_cookie_default( |
| 258 | func nxss_scan_until(buf: *u8, end: i64, start: i64, called by 1: nx_http_session_parse_cookie |
| 270 | func nxss_skip_ws(buf: *u8, end: i64, start: i64) -> i64 called by 1: nx_http_session_parse_cookie |
| 280 | func nxss_bytes_eq(a: *u8, b: *u8, n: i64) -> i64 called by 1: nx_http_session_parse_cookie |
| 289 | func nx_http_session_parse_cookie( |