feat(web): async session-store seam + Web.Sessions middleware [L03.01.01.14] - #925
Merged
Conversation
Commit 6688b71 renamed HttpAuthenticationFeature -> AuthenticationFeature but left HttpContextAuthenticationExtensions (namespace Assimalign.Cohesion.Web.Authentication) without a using for the child .Internal namespace where the concrete type lives, breaking the Web.Authentication build and every project that references it — including the Web.Hosting test project this task needs to verify. Add the missing using. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…al via OnError hook [L03.01.01.19] Implements #881 as a CONSUMER of the shipped #864 OnError chain (PR #893), re-scoped from the issue's IResult design: IResult was withdrawn pre-merge, so the Web area is middleware-first and there is no result-carrier channel. No IResult, no Results.Problem/ExecuteResultAsync, no second handler abstraction. Web.ErrorHandling (new pipeline verbs, homed with AddErrorHandling): - UseErrorHandling() installs the exception-boundary middleware: catches faults escaping downstream, publishes IHttpExceptionFeature (caught exception + path), and on an unstarted response resets it and dispatches through the shipped IErrorHandlingFeature.Handlers chain (registration order, first-true wins) to the ProblemDetails-500 terminal. No-clobber: when IHttpResponseStreamingFeature .HasStarted reports the head is committed, it aborts the one exchange via IHttpContext.CancelAsync instead of half-writing (connection survives). - Developer-detail toggle (off by default) enriches only the boundary's terminal fallback. OnException observation hook + SuppressDiagnosticsCallback are the Cohesion parity for .NET 10 SuppressDiagnosticsCallback (no Microsoft.Extensions logging). Handler faults propagate, never masked (shipped OnError semantics); an observer fault is swallowed (observation must not defeat rendering). - UseStatusCodePages() upgrades a bodyless 4xx/5xx terminal response into problem+json (or a custom responder). Web.Hosting: - The silent Task.CompletedTask pipeline terminal now sets a bodyless 404 for an unhandled request (still 200, no body/content-type/location). It stays payload- free because COHRES002 forbids the runtime module referencing Web.ProblemDetails; UseStatusCodePages upgrades it. A deliberate empty 200 must be terminal (not chain to next) — the TLS integration test's terminal handler is adapted to match. Tests: 22 new Web.ErrorHandling unit tests + 3 end-to-end (UseErrorHandling default, handler-owns, UseStatusCodePages 404 upgrade) + 3 Web.Hosting terminal tests. Docs: Web.ErrorHandling DESIGN/OVERVIEW, Web.Hosting DESIGN, Web README updated; fixed the IHttpErrorHandler/IHttpErrorHandlingFeature naming drift in OVERVIEW. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ature naming drift Review follow-ups on the #881 branch: implement IWebApplicationContext.ContentRootPath on the Web.Routing TestWebApplicationContext (stale since 6688b71) and correct the IHttpErrorHandlingFeature -> IErrorHandlingFeature name drift in the ErrorHandling csproj description, xmldoc, and DESIGN.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…1.02.01.02] Adds server-side content negotiation as a thin layer over the #864 content-serialization registry (#149), reusing the #771 `HttpContentNegotiation` q-value/precedence primitive rather than re-implementing selection. - `HttpContentNegotiationExtensions`: `IHttpContentSerializationFeature.TryNegotiate` (pure, non-throwing seam over the registered writers), `IHttpContext.TryNegotiateContentType` (reads the exchange's Accept), and `IHttpContext.WriteNegotiatedContentAsync<T>` (negotiate -> write via the registry's explicit media-type overload, or compose a 406). - `ContentNegotiator` (internal): collects the writers' concrete media types in server-preference order and delegates exact RFC 9110 §12.5.1 matching to the primitive. - Structured-suffix fallback (the call #864 deferred to #149): a bare base-type Accept range (application/json) is satisfied by a registered structured-suffix writer (application/problem+json) only when exact matching yields nothing; already-suffixed ranges are never widened, q=0 refusals are honored, and `application/*+json` wildcard-suffix ranges stay unsupported (a #771 parser gap, recorded not duplicated). - `Vary: Accept` appended (never clobbering an existing Vary) on negotiated responses and the 406; no acceptable representation is a bodyless 406 outcome the #881 status-code-pages middleware upgrades, while a missing registry stays the existing composition fault. - Media types only; Accept-Charset/Language and the client half are non-goals. DESIGN.md/OVERVIEW.md updated in the same change. 15 new tests (11 unit + 4 pipeline); Web.Serialization 42, Web.ErrorHandling 37, Web.Hosting 49 all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…on [L03.01.01.08] New resources/Web feature package housing both directions of HTTP body compression over BCL codecs only (GZipStream/BrotliStream/ZLibStream), AOT-safe, builder-time options, no Microsoft.Extensions.* and no hosting reference. Response side (UseResponseCompression): negotiates gzip/brotli from Accept-Encoding via the shared Http #771 primitives, wrapping IHttpResponse.Body with a first-write-deferred decision stream (there is no header-commit hook). It stamps Content-Encoding, drops the stale Content-Length so the transport re-synthesizes it, and always appends Vary: Accept-Encoding for eligible media types (no-clobber over an existing Accept token). Honors a size threshold without buffering whole responses, never double-compresses already-encoded content, and hands off cleanly to streamed responses. Off by default for HTTPS dynamic content (BREACH, CVE-2013-3587) via an explicit EnableForHttps opt-in. Per-response opt-out via IResponseCompressionFeature. Request side (UseRequestDecompression): transparently inflates gzip/br/deflate bodies by decorating the exchange (IHttpRequest.Body is get-only), enforcing a decompressed- size guard (413) against zip bombs, 415 on unsupported codings, 400 on malformed content, and decoding multi-coding chains (Content-Encoding: gzip, br) in reverse application order. Wiring: App.Web framework manifest, root + Web solutions, resource-web CI matrix, and the Web README project map. Docs: OVERVIEW.md + DESIGN.md. Tests: 27 (in-memory factory E2E for both directions incl. round-trips, threshold, Vary append, 413/415/400, multi-coding; unit tests for the BREACH gate and MIME matcher). Web.ErrorHandling/Serialization/Hosting stack suites remain green. No new Http-core primitive was needed: HttpAcceptParser.ParseAcceptEncoding + HttpContentNegotiation.TrySelectEncoding (#771) already cover content-coding/q-value parsing and identity;q=0 semantics. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…port-Security header key [L03.01.01.09] Add resources/Web/Assimalign.Cohesion.Web.HttpsPolicy, one lean feature package pairing both HTTPS-posture concerns as extension(IWebApplicationPipelineBuilder) verbs (no DI/config/logging; refs Web + Http only, never Web.Hosting): - UseHttpsRedirection: insecure request -> bodyless method-preserving redirect (307 default, 308 configurable); Location rebuilt from the request (https scheme, host with its port swapped to the configured HTTPS port — 443 omitted, IPv6 re-bracketed; path verbatim; query reconstructed from the parsed collection). HttpsPort is explicit (Web.Hosting isolation forbids deriving it). - UseHsts: RFC 6797 Strict-Transport-Security composed once at builder time (max-age default 365d, includeSubDomains, preload), emitted on secure responses only (RFC 6797 7.2), loopback (localhost/127.0.0.1/[::1]) excluded by default via the core HttpHostMatcher. Applied post-next (outside the #881 boundary) so it survives the boundary's header reset on a faulted response; skipped on a committed head via IHttpHeaderCollection.IsReadOnly. Connection security is read from the transport-derived typed IHttpRequest.Scheme (#763), not scheme-string sniffing. Also fix HttpHeaderKey.StrictTransportSecurity value from the misspelled "Strict-Transports-Security" to "Strict-Transport-Security" (RFC 6797), with round-trip tests through IHttpHeaderCollection (member name unchanged). Wiring: App.Web manifest, both slnx files, resource-web.yml matrix, README map, OVERVIEW/DESIGN docs. Tests: 32 new (redirection + HSTS) via unit-level context and pipeline-builder doubles; 3 new core Http header-key tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… detection Review follow-up: Request.Scheme is the immediate hop; Web.ForwardedHeaders deliberately never mutates it, so document the plaintext-hop redirect-loop hazard and the IHttpForwardedFeature follow-up rather than leaving it implicit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…cies [L03.01.01.12] New resources/Web feature package adapting the BCL System.Threading.RateLimiting engine to the Web pipeline — supplying the middleware, policy model, partition-key surface, and rejection response, never a limiter algorithm (#783). - UseRateLimiting composes a global limiter (applied to every request, acquired up-front with full queueing) plus named policies attached per-endpoint as the sealed RateLimitingMetadata carrier in the routing metadata bag. - Per-endpoint gating mirrors the Web.RequestTimeouts seam: a decorated context reads the matched endpoint's metadata at the router's route-match publication. Since the router matches and dispatches in one middleware, the sync gate uses AttemptAcquire and raises an internal signal the middleware catches to answer before the handler runs. Global + endpoint are additive (both must grant a lease). - Partitioned via PartitionedRateLimiter<IHttpContext> with AOT-safe selectors: RateLimitPartitionKeys.ClientAddress composes the Http.Forwarded effective client (trust-gated; BCP 38 caution documented), plus Header and typed selectors. - Rejection: 429 (configurable) + Retry-After from lease metadata, OnRejected hook (bodyless default composes with #881 status-code pages), OnDecision observation hook in place of a hosting-layer OTel seam (re-scoped, follow-up recorded). - IRateLimitingFeature exposes the decision downstream. Limiters live for the application lifetime; per-request leases released on completion (disposal posture documented). Wiring: App.Web manifest, both slnx, resource-web.yml matrix, README project map, OVERVIEW/DESIGN docs. System.Threading.RateLimiting is not added to the framework manifest — it carries only Cohesion assemblies, matching the existing Resilience.RateLimiting precedent in base App. 20 new tests (15 middleware unit + 5 e2e over WebApplicationTestFactory), all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ception boundary Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
….01.14] Http.Sessions: add the async IHttpSessionStore seam (get/set/renew/remove keyed by session id, opaque byte[] payload, idle-timeout metadata) with the in-memory dictionary moved behind it as the default InMemoryHttpSessionStore. Payload framing is a version-prefixed, length-prefixed binary codec (HttpSessionSerializer) — no reflection — so any store round-trips identical bytes. The concurrency contract is last-commit-wins (documented on the interface + DESIGN.md, pinned by tests); sliding expiration is renew-on-access. An internal store-backed session composes the store with the frame codec. Every existing IHttpSession caller and test is unchanged. Web.Sessions: fill the empty scaffold with the per-request middleware. UseSessions installs a lazy, store-backed session on the exchange (no store I/O or cookie until first access), establishes a hardened session-id cookie (HttpOnly, SameSite=Lax, Secure on HTTPS, session-scoped) via the Http.Cookies model synchronously at id-mint time (before the head commits), and commits after next (persist-if-modified, else slide). Session ids are 128-bit crypto-random base64url; RegenerateSessionIdAsync is the post-auth fixation defense (new id, old id removed, cookie replaced). Distributed backends are deferred to IHttpSessionStore adapters. Wiring: Web.Sessions docs (OVERVIEW/DESIGN), Http.Sessions DESIGN.md scope update, README project-map row, slnx docs entries. Manifest + CI matrix already carried the scaffold; App.Web.Runtime pack validated with both assemblies. Tests: Http.Sessions 47 (23 existing regression + 24 new), Web.Sessions 15 (unit middleware + e2e round-trip over WebApplicationTestFactory). Stack regressions green (ErrorHandling/Serialization/Compression/HttpsPolicy/ RateLimiting/Hosting). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t be delivered Review follow-ups on the #785 branch: a session first accessed after the response head commits mints an id the client can never present again — skip the store persist instead of littering the store until idle-timeout reaping (externally supplied sessions keep their caller-owned commit lifecycle); pin with a RecordingSessionStore fixture and an existing-cookie-after-head counterpart test; true up the stale Http.Sessions csproj description (Items bag -> typed feature collection). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dotnetcadet
added a commit
that referenced
this pull request
Jul 20, 2026
…ack reconciliation) PRs #920-#925 squash-merged to main leave this stacked branch's copy of those commits content-identical but history-divergent; the only textual conflicts were Web.Caching's wiring lines sitting alphabetically adjacent to Web.Compression's in App.props, the CI matrix, both slnx files, and the README project map - resolved to the union. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stack 6/8 of the Web/Http Batch 4b stacked series (base:
feature/L03.01.01.12-rate-limiting, PR #924).Two coordinated halves per the issue:
Http.Sessions— the async store seamIHttpSessionStore:GetAsync/SetAsync/RefreshAsync/RemoveAsync— opaquebyte[]payload + idle-timeout metadata,ValueTasksync-fast-path. The existing in-memory dictionary moved behind it (InMemoryHttpSessionStore,TimeProvider-driven); every pre-existingIHttpSessioncaller and all 27 pre-existing tests unchanged.SetAsyncis an unconditional wholesale overwrite, no per-key merge, CAS/ETag deliberately outside the seam (a CAS-capable backend like Database.KeyValuePair may expose stronger guarantees via its own adapter surface). Stated on the interface docs as THE contract distributed stores implement; tested at store and session level.HttpSessionSerializer: version-prefixed, length-prefixed binary framing (big-endian, no reflection); unreadable frames degrade to an empty session, never fault the request.Web.Sessions— the empty scaffold, filledUseSessions()(+ custom-store overload): lazy per-request feature — zero store I/O and no cookie until first access;Set-Cookieminted synchronously at id-mint (before the head can commit), post-nextcommit touches only the store. Persist-if-modified,Refreshslide for merely-accessed sessions, nothing for untouched ones.SameSite=Lax,Securebound to the transport-derived scheme, session-scoped (no Max-Age); Name/Path fromHttpSessionOptions(unchanged type).RegenerateSessionIdAsync()fixation defense (new id, state re-keyed, old id removed, cookie replaced; throws after head-start).RecordingSessionStoretest plus an existing-cookie-after-head counterpart proving normal commits survive a started head.Wiring
Scaffold predated manifest/CI wiring — verified all present (App.props already listed both assemblies; CI matrix and slnx skeletons existed); added the missing csproj references (Http/Http.Cookies/Http.Streaming + test refs), docs entries, README row. Pack validated with both DLLs collected. COHRES-clean.
Tests
Http.Sessions 47 (20 new) · Web.Sessions 16 (all new; e2e proves cookie round-trip through the factory client's CookieContainer) — plus stack regressions all green (ErrorHandling 37, Serialization 42, Compression 27, HttpsPolicy 32, RateLimiting 20, Hosting 49).
Follow-up candidates (not filed)
Distributed store adapters (first:
Database.KeyValuePair— exists with etag/CAS per #916) · configurable SameSite/Domain onHttpSessionOptions.Closes #785
🤖 Generated with Claude Code