Skip to content

feat: session binding#2310

Open
lfleischmann wants to merge 8 commits into
mainfrom
feat-session-binding
Open

feat: session binding#2310
lfleischmann wants to merge 8 commits into
mainfrom
feat-session-binding

Conversation

@lfleischmann
Copy link
Copy Markdown
Member

@lfleischmann lfleischmann commented Dec 3, 2025

Description

These changes add anonymous sessions and result in binding these anonymous sessions to flows.

Implementation

Backend

  • Make user id in session model optional (no DML/migration needed since it was not enforced on DB level anyway)
  • Issue anonymous session cookie
  • "Rotate" anonymous sessions to authenticated sessions in hook issuing an authenticated session
  • Add reference to session ID in flows
  • Extend flowpilot to pass session ID through to creation/updates of flows

@lfleischmann lfleischmann force-pushed the feat-session-binding branch from e2afe2a to 130e606 Compare March 9, 2026 07:28
Comment thread backend/config/config_default.go Outdated
},
Session: Session{
Binding: Binding{
Enabled: true,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should disable this by default, since this might cause problems, depending on the domain setup.


// If we are here, we are initializing a flow.
// If we have a session for the given cookie, we simply use the existing session.
if sessionModel != nil {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should add a grace period here and should check how long the session is still valid and e.g. when it's only valid for 10 minutes, we should create a new session.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you give a suggestion?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants