HMAC cookies are not a session store
Situation: the writer cookie leaks in a screenshot. There is no “log out all sessions” table. The cookie is unix.hmac. If the HMAC matches and the unix timestamp is still in the window, the desk opens.
That is a trade: one sqlite file, no Redis session. The cost is revocation.
SDE II response:
- Short expiry.
- Secret from the environment, not a compiled default in production.
- Cookie flags:
HttpOnly,Secure,SameSite=Stricton the real domain. - Changing the secret invalidates every cookie. That is the kill switch.
- Markdown is escaped so a draft cannot steal the cookie with a script tag.
If I needed revoke-one-user, I would add a token_id in the cookie and a tiny sqlite table of revoked ids. I have not, yet. The honest README says so.
People say “JWT is stateless” and then cannot name the logout hole. This post is that name.