Repository navigation
Fix browser clearance renewal and prepare SDK 0.18.5 - #63
Merged
Merged
Conversation
cport1
changed the title
cport1
marked this pull request as ready for review
October 13, 2026 00:52
cport1
added a commit
that referenced
this pull request
Oct 16, 2026
…rts (#62) * fix(security): send credential headers by name only in detection reports Detection reports carried the request's full header map, so a visitor's session cookie, bearer token or API key header was sent with every report. toWireDetectionRequest now replaces credential header values with an empty string and keeps only WebDecoy's own wd_clearance cookie. Rules still see the full request. * Fix browser clearance renewal and prepare SDK 0.18.5 (#63) * Keep browser clearance renewal running across token lifetimes * Prepare SDK 0.18.5 release and document clearance lifecycle * Add opt-in bounded API clearance recovery for browser reads (#64)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clearance renewal previously returned while the cookie was present and left no next timer; existing-cookie startup also failed to schedule renewal. One per-page lifecycle now reuses fresh cookies, renews before expiry, coalesces requests, caches fingerprint work, notices another tab changing the cookie, and checks after visibility resume. Transient failures back off with a request timeout; explicit server refusal stops automatic attempts. Unsigned expiry remains a bounded scheduling hint, and the server re-evaluates accepted behavioral evidence on each mint.
Prepares SDK 0.18.5 across the six publishable packages and internal dependency ranges, with lockfile, changelog, package/root README and agent-facing usage guidance updated. Application fetch/XHR recovery is still separate work.
Tracks WebDecoy/app#1571. Retained Chrome/REA evidence: https://github.com/WebDecoy/app/pull/1577.
Validation: all 31 browser-client tests, build and lint pass (existing package-export/lint warnings). The generated standalone bundle in Chrome completed startup plus two renewal cycles under a simulated clock, with a Secure, SameSite Lax, host-only cookie. Node 20/22 workspace CI validates the final release head. Live signed-token and full simultaneous multi-tab validation remain tracked by WebDecoy/app#1574/#1575.
After merge, tag v0.18.5 triggers the existing workspace npm publication workflow. Registry artifacts will be checked before reporting the release complete.