fix(web): relay rotated session cookie on admin redirects (BUNYIP-67) #85

Merged

nrupard merged 1 commit from fix/bunyip-67-admin-redirect-cookies into main

2026-06-09 20:58:38 +02:00

nrupard commented

2026-06-09 20:55:10 +02:00

Owner

Problem

Nine admin handlers in bunyip-web/src/handlers/admin.rs ended their post-action redirect with a plain redirect(path), dropping any session cookie the admin guard rotated during the request (a refreshed JWT). When the guard rotated the cookie, the browser kept the stale one; if the old cookie had already expired, the admin was silently logged out on the next request. The action itself still succeeded (the API call runs before the redirect), so only the cookie relay was lost. The user-management handlers and the BUNYIP-65 application_delete fix already use redirect_cookies; these nine had diverged.

Fix

Switch all nine to redirect_cookies(path, &c.set_cookies), converging the admin module on one redirect convention. No behavior change beyond the cookie relay; the API calls and redirect targets are unchanged.

Handlers fixed: feedback_status, application_field, application_distribution_save (success arm), application_create (success arm), set_app_restricted, grant_user_entitlement_h, revoke_user_entitlement_h, tier_settings_save, stripe_save. The error arms of the two application_* handlers already relayed cookies via admin_response and are untouched. redirect is no longer referenced in the module, so it is dropped from the import.

Test

just check-container green: fmt + clippy (-D warnings, which catches the now-unused import) + workspace lib tests. Grep confirms no remaining plain redirect( in an admin handler.

#BUNYIP-67

## Problem Nine admin handlers in `bunyip-web/src/handlers/admin.rs` ended their post-action redirect with a plain `redirect(path)`, dropping any session cookie the admin guard rotated during the request (a refreshed JWT). When the guard rotated the cookie, the browser kept the stale one; if the old cookie had already expired, the admin was silently logged out on the next request. The action itself still succeeded (the API call runs before the redirect), so only the cookie relay was lost. The user-management handlers and the BUNYIP-65 `application_delete` fix already use `redirect_cookies`; these nine had diverged. ## Fix Switch all nine to `redirect_cookies(path, &c.set_cookies)`, converging the admin module on one redirect convention. No behavior change beyond the cookie relay; the API calls and redirect targets are unchanged. Handlers fixed: `feedback_status`, `application_field`, `application_distribution_save` (success arm), `application_create` (success arm), `set_app_restricted`, `grant_user_entitlement_h`, `revoke_user_entitlement_h`, `tier_settings_save`, `stripe_save`. The error arms of the two `application_*` handlers already relayed cookies via `admin_response` and are untouched. `redirect` is no longer referenced in the module, so it is dropped from the import. ## Test `just check-container` green: fmt + clippy (`-D warnings`, which catches the now-unused import) + workspace lib tests. Grep confirms no remaining plain `redirect(` in an admin handler. #BUNYIP-67

nrupard added 1 commit

2026-06-09 20:55:10 +02:00

fix(web): relay rotated session cookie on admin redirects (BUNYIP-67)

Check / fmt / clippy / build / test (pull_request) Successful in 1m4s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

9b9c328f5e

Nine admin handlers in bunyip-web finished with a plain `redirect(path)` after their action, dropping any session cookie the admin guard rotated during the request (a refreshed JWT). When the guard rotated the cookie, the browser kept the stale one; in the worst case (the old cookie already expired) the admin was silently logged out on the next request. The action itself still succeeded because the API call runs before the redirect, so only the cookie relay was lost.

Switch all nine to `redirect_cookies(path, &c.set_cookies)`, the convention the user-management handlers and the BUNYIP-65 application_delete fix already use, converging the admin module on one redirect path. Handlers fixed: feedback_status, application_field, application_distribution_save (success arm), application_create (success arm), set_app_restricted, grant_user_entitlement_h, revoke_user_entitlement_h, tier_settings_save, stripe_save. The error arms of the two application_* handlers already relayed cookies via admin_response and are unchanged. `redirect` is no longer referenced in the module, so it is dropped from the import.

#BUNYIP-67

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>