fix(webconsole): key the cookie deletions on the same conjunct as the set (BACKLOG #1117) (#756)

The set site keys Secure on effective_https alone; the clear site inferred it from
the resolved cookie NAME, which is effective_https AND browser_hardening_enabled().
With the org opt-out set over https -- a startable posture -- session_cookie_name
returned the bare name, the clear took the unprefixed branch, and Starlette's
delete_cookie defaults (secure=False, httponly=False, samesite="lax") revoked a
Secure + HttpOnly + Strict cookie with a bare one. Three attributes lost rather than
one: the 2026-08-20 research named Secure, and the same branch also drops HttpOnly
and downgrades SameSite from Strict to Lax.

clear_session_cookie and clear_oidc_flow_cookie now take secure from the same
effective_https call the set sites use, with no branch at all, so the two sites
cannot drift apart again by an edit to either.

Nothing is deployed, so nothing is exposed today. On a first deployment this would
reach the org-opt-out and declared-proxy postures.

Tests: a posture matrix comparing the clear's guards against the set's across all
four postures, with a positive control in the same run that Secure does move with
the scheme, plus an end-to-end logout on the posture that used to lose the
attributes. Seven of the new cases failed before the change.

The BACKLOG entry additionally records the measurement that ADR 0172 already killed
this item's founding premise: the default startable configuration now mints a
self-signed pair and serves https, so both limbs of ASVS 3.3.1 hold on the shipped
default with no line of _auth.py changed. That measurement is a record, not a
re-score -- the scorecard move stays an act on the record of record.

Co-authored-by: wshallwshall <mefordev@messagefoundry.org>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

docs/BACKLOG.md

@@ -7689,6 +7689,18 @@ filing.
 
 **Proposed work, by subject, all unallocated:** the browser-acceptance measurement, observed as STORED across Chrome, Edge, Firefox and Safari, which gates the re-key mechanism and must run before it is designed; the transport mechanism, shared with the 3.3.3 item and already filed as #1276; correcting the in-tree premise that a browser rejects a Secure or `__Host-` cookie over http (`_auth.py:113-114`, `_security.py:24-25`, `_security.py:112-118`, ADR 0143, and two contradicting sites in the withheld runbook), which is worth doing whatever the mechanism because three cells stand on it; fixing the clear-path opt-out asymmetry so the set and clear sites consult the same conjuncts; grading and repairing the two deletion blocks; adding the OIDC flow cookie and the Kerberos SSO route to whatever record grades this cell; striking "introduction of a `__Secure-` fallback name" from the cell's re-score triggers, since `__Secure-` requires Secure exactly as `__Host-` does and both cookies already ship `path="/"` with no Domain (`_auth.py:746`, `:823`), so no reachable state has one available and not the other; and reporting the browser-hardening opt-out on stderr at startup, which is shared work across several cells.
 
+**Measured 2026-09-03 at `c2237d783`: this item's FOUNDING PREMISE is FALSE, and the third mechanism the research named as dissolving the contest is the one that shipped.** The premise was that "the default startable configuration is not an https context". It now is. ADR 0172 landed the #1276 mint-and-serve half: `ensure_api_tls_material` (`messagefoundry/api/tls.py:87`) mints a self-signed pair when no `[api].tls_cert_file` is configured, wired unconditionally into `uvicorn.run` at `messagefoundry/__main__.py:2885` and `:2901`. Driven rather than read: `ApiSettings()` still defaults `host='127.0.0.1'` (`config/settings.py:731`) and `serve_ui=True` (`:739`), and against a temp state dir that call returns a minted pair. The socket is https, so `effective_https` (`_auth.py:91`) is true and the default `/ui` login writes `__Host-mf_session=...; HttpOnly; Path=/; SameSite=strict; Secure` -- both limbs of the pinned verb, on the shipped default, with no line of `_auth.py` changed. The mechanism contest is therefore MOOT rather than resolved: nobody chose between the re-key and the transport, and the transport landed under a different item.
+
+**The one topology ADR 0172 excludes does not reopen it.** The enumeration is bounded by the function rather than by recollection: `ensure_api_tls_material` has three return paths, and each lands `effective_https` true. An operator certificate returns it unchanged and sets `tls_enabled`; no certificate mints and the socket is https; `tls_terminated_upstream` returns no material (`api/tls.py:128-129`) and the engine speaks plaintext to the declared proxy, but `config/settings.py:979` refuses to START that topology without `trusted_proxies`, so `exposure_protected` (`:850`) is true there. Measured on the first and third arms in one run: a minted pair on the default, `material=None` with `exposure_protected=True` on the declared-proxy arm. The undeclared-proxy topology in this item's Severity paragraph also stops being a silent posture, because the engine serves only TLS on that bind -- a proxy speaking cleartext to it fails the handshake instead of downgrading quietly.
+
+**Do NOT read that as a pass, and do not re-score on it alone.** Two things survive. The residual #1118 named is unrun: whether a browser STORES a `__Host-` cookie over https served with an untrusted self-signed chain. Until someone runs it the shipped default is correct by construction and unverified in a browser, which is weaker than pass. And both limbs still key on one boolean, so this item's structural complaint outlives its factual one.
+
+**Landed 2026-09-03: the clear-path asymmetry, which holds under either mechanism, and the loss was three attributes rather than one.** The set site keys Secure on `effective_https` alone; the clear site inferred it from the resolved NAME, which is `effective_https AND browser_hardening_enabled()`. With the org opt-out set over https -- a startable posture -- `session_cookie_name` returned the bare name, the clear took the unprefixed branch, and Starlette's `delete_cookie` defaults (`secure=False, httponly=False, samesite="lax"`) revoked a Secure + HttpOnly + Strict cookie with a bare one. The research named Secure; the same branch also drops HttpOnly and downgrades SameSite from Strict to Lax. `clear_session_cookie` (`_auth.py:777`) and `clear_oidc_flow_cookie` (`:864`) now take `secure` from the same `effective_https` call the set site uses, with no branch at all, so the two sites cannot drift apart again by an edit to either. Pinned by a posture matrix in `packaging/messagefoundry-webconsole/tests/test_ui_hardening.py` comparing the clear's guards against the set's across all four postures, with a positive control in the same run that Secure does move with the scheme.
+
+**The rewritten docstring did not make the asymmetry false, and re-measuring it was the point.** The `clear_session_cookie` docstring had been rewritten since the 2026-08-20 research to state that the `__Host-` deletion carries Secure. That was true, and it did not cover the reachable third state -- the bare name over https under the opt-out -- which is exactly where the loss happened. A docstring describing two of three branches reads to the next person as a completeness claim.
+
+**Scope corrections recorded here so they are not re-derived.** At least these four, established by the 2026-08-20 research and re-checked at `c2237d783`: the two deletion blocks are ungraded by the cell; a third session-minting route exists on the Kerberos SSO leg (`messagefoundry_webconsole/routes/sso.py:87`), beyond the two the record enumerates; the OIDC flow cookie fails both limbs on the same postures and is named by neither this item nor the cell; and `__Secure-` requires Secure exactly as `__Host-` does, so no reachable state has one available and not the other. The clear-path fix above closes one line of the proposed work and grades none of the rest -- the scorecard move stays an act on the record of record, not a consequence of this entry.
+
 ## 1118. research an honest pass for ASVS 3.3.3 -- keeping the __Host- prefix on the shipped default without breaking a cleartext loopback login
 
 > 🔢 **Re-scored 2026-08-20 -> P2.** Value **6/10** · Difficulty **4/10** · _quick win_. Verified at HEAD: both cookies resolve to their __Host- twin only under effective_https AND browser_hardening_enabled (messagefoundry_webconsole/_auth.py:739 and :815), HOST_COOKIE_NAME at :70 documents that cleartext keeps the bare name by design, and the opt-out env at :77 reverts to the bare name with nothing at start reporting the reversion. Difficulty 4 covers a research pass that has to settle a loopback-TLS or auto-TLS posture question for the default /ui bind rather than edit cookie code, with cannot-honestly-pass a valid outcome. _(was 6/10 · 4/10.)_

messagefoundry_webconsole/_auth.py

@@ -778,10 +778,18 @@ def clear_session_cookie(response: Response, request: Request) -> None:
     """End this browser's session: delete the session cookie AND stamp
     :data:`CLEAR_SITE_DATA_HEADER` (ASVS 14.3.1). Pairs with a server-side revoke.
 
-    Deletes whichever name this scheme uses (:func:`session_cookie_name`). Over cleartext loopback the
-    DELETION stays byte-identical to the pre-#192 clear (``delete_cookie(COOKIE_NAME, path="/")``); the
-    ``__Host-`` deletion additionally carries Secure so the browser accepts the expiry (a ``__Host-``
-    cookie is only writable — expiry included — over a Secure connection).
+    Deletes whichever name this scheme uses (:func:`session_cookie_name`), carrying **the same guards
+    :func:`set_session_cookie` wrote**: Secure keyed on :func:`effective_https`, plus HttpOnly and
+    SameSite=Strict. A ``__Host-`` cookie is only writable — expiry included — over a Secure
+    connection, so keying the deletion the same way is also what makes the expiry land.
+
+    **Why the deletion reads ``effective_https`` and not the resolved name (BACKLOG #1117).** The two
+    are different conjuncts: the set keys Secure on ``effective_https`` alone and the NAME on
+    ``effective_https AND browser_hardening_enabled()``. Inferring Secure from the name therefore lost
+    it whenever the two disagreed — with the org opt-out set over https, this took the unprefixed
+    branch into Starlette's ``delete_cookie`` defaults (``secure=False, httponly=False,
+    samesite="lax"``) and revoked a Secure + HttpOnly + Strict cookie with a bare one. One expression,
+    no branch, so the two sites cannot drift apart again by an edit to either.
 
     The header is set HERE rather than beside each call site because deleting the session cookie IS
     the browser-visible end of a session: fusing them makes the 14.3.1 control structurally
@@ -792,11 +800,13 @@ def clear_session_cookie(response: Response, request: Request) -> None:
     change) are terminations; a future caller that deletes the cookie without ending the session would
     be the anomaly and must justify itself, not the other way round.
     """
-    name = session_cookie_name(request)
-    if name == COOKIE_NAME:
-        response.delete_cookie(COOKIE_NAME, path="/")
-    else:
-        response.delete_cookie(name, path="/", secure=True, httponly=True, samesite="strict")
+    response.delete_cookie(
+        session_cookie_name(request),
+        path="/",
+        secure=effective_https(request.app.state, request.url.scheme),
+        httponly=True,
+        samesite="strict",
+    )
     response.headers[CLEAR_SITE_DATA_HEADER] = CLEAR_SITE_DATA_VALUE
 
 
@@ -854,12 +864,20 @@ def set_oidc_flow_cookie(
 def clear_oidc_flow_cookie(response: Response, request: Request) -> None:
     """Delete the flow cookie. Called on EVERY terminal callback response, success or failure: the
     server-side flow is single-use, so a surviving cookie would make the next callback present a flow
-    id that no longer resolves — a confusing ``flow_binding_missing`` on an otherwise clean retry."""
-    name = oidc_flow_cookie_name(request)
-    if name == FLOW_COOKIE_NAME:
-        response.delete_cookie(FLOW_COOKIE_NAME, path="/")
-    else:
-        response.delete_cookie(name, path="/", secure=True, httponly=True, samesite="lax")
+    id that no longer resolves — a confusing ``flow_binding_missing`` on an otherwise clean retry.
+
+    Carries the same guards :func:`set_oidc_flow_cookie` wrote, keyed on the same
+    :func:`effective_https` call — see :func:`clear_session_cookie` for why the resolved NAME is the
+    wrong thing to infer Secure from (BACKLOG #1117). ``SameSite=Lax`` mirrors the set for the same
+    reason the set has it: the IdP's redirect back is a top-level cross-site GET.
+    """
+    response.delete_cookie(
+        oidc_flow_cookie_name(request),
+        path="/",
+        secure=effective_https(request.app.state, request.url.scheme),
+        httponly=True,
+        samesite="lax",
+    )
 
 
 # --- L5a: WebAuthn RP identity (ADR 0068 §7) --------------------------------------

packaging/messagefoundry-webconsole/tests/test_ui_hardening.py

@@ -8,15 +8,25 @@
 from __future__ import annotations
 
 import re
+from types import SimpleNamespace
 
 import httpx
 import pytest
+from starlette.requests import Request as StarletteRequest
+from starlette.responses import Response as StarletteResponse
 
 from messagefoundry.api import create_app
 from messagefoundry.auth import Role
 from messagefoundry.auth.service import AuthService
 from messagefoundry.config.settings import AuthSettings
 from messagefoundry.pipeline import Engine
+from messagefoundry_webconsole._auth import (
+    BROWSER_HARDENING_OPT_OUT_ENV,
+    clear_oidc_flow_cookie,
+    clear_session_cookie,
+    set_oidc_flow_cookie,
+    set_session_cookie,
+)
 
 PW = "a-strong-test-passphrase"  # >=15, no app/vendor terms — satisfies the ASVS policy (WP-3)
 _NONCE_RE = re.compile(r"script-src 'nonce-([A-Za-z0-9_-]+)' 'strict-dynamic'")
@@ -335,3 +345,146 @@ async def test_opt_out_reverts_to_legacy_over_https(
         assert "window.isSecureContext" not in page.text  # opt-out reverts -> banner not emitted
         # the reverted plain cookie still authenticates (name resolver agrees on read)
         assert (await c.get("/ui")).status_code == 200
+
+
+# --- BACKLOG #1117: the CLEAR site consults the same conjuncts as the SET site --------------------
+#
+# The set site keys Secure on ``effective_https`` ALONE and the name on ``effective_https AND
+# browser_hardening_enabled()``. The clear site used to infer Secure from the resolved NAME, so under
+# the org opt-out over https it took the unprefixed branch and reached Starlette's ``delete_cookie``
+# defaults (``secure=False, httponly=False, samesite="lax"``) -- dropping three attributes the set
+# had just written. These pin the two sites to one expression.
+
+
+def _cookie_request(scheme: str, *, exposure_protected: bool = False) -> StarletteRequest:
+    """A bare Request carrying only what the cookie helpers read: the scheme and ``app.state``."""
+    return StarletteRequest(
+        {
+            "type": "http",
+            "http_version": "1.1",
+            "method": "POST",
+            "scheme": scheme,
+            "path": "/ui/logout",
+            "raw_path": b"/ui/logout",
+            "query_string": b"",
+            "root_path": "",
+            "headers": [(b"host", b"t")],
+            "client": ("127.0.0.1", 1234),
+            "server": ("t", 443 if scheme == "https" else 80),
+            "app": SimpleNamespace(
+                state=SimpleNamespace(exposure_protected=exposure_protected, loopback=False)
+            ),
+        }
+    )
+
+
+#: The attributes a browser reads as security posture. Deliberately NOT the whole attribute set: a
+#: deletion also carries ``max-age``/``expires``, which the set legitimately does not.
+_GUARD_ATTRS = ("secure", "httponly", "samesite")
+
+
+def _guards(response: StarletteResponse) -> tuple[str, dict[str, str]]:
+    """The cookie NAME plus its security attributes, from the one ``Set-Cookie`` on the response."""
+    lines = [v.decode() for k, v in response.raw_headers if k == b"set-cookie"]
+    assert len(lines) == 1, lines
+    head, _, rest = lines[0].partition(";")
+    attrs: dict[str, str] = {}
+    for part in rest.split(";"):
+        if not part.strip():
+            continue
+        key, _, value = part.strip().partition("=")
+        if key.strip().lower() in _GUARD_ATTRS:
+            attrs[key.strip().lower()] = value.strip().lower()
+    return head.split("=", 1)[0], attrs
+
+
+_POSTURES = [
+    pytest.param("https", True, id="https-hardened"),
+    pytest.param("https", False, id="https-org-opt-out"),
+    pytest.param("http", True, id="cleartext-hardened"),
+    pytest.param("http", False, id="cleartext-org-opt-out"),
+]
+
+
+@pytest.mark.parametrize(("scheme", "hardening"), _POSTURES)
+def test_session_clear_carries_the_same_guards_as_the_set(
+    scheme: str, hardening: bool, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """On EVERY posture the session deletion carries the same name, Secure, HttpOnly and SameSite as
+    the emission it revokes. A deletion that drops Secure is a cookie written without Secure, which is
+    what ASVS 3.3.1 grades -- and one that drops HttpOnly hands script a name the set had hidden."""
+    if hardening:
+        monkeypatch.delenv(BROWSER_HARDENING_OPT_OUT_ENV, raising=False)
+    else:
+        monkeypatch.setenv(BROWSER_HARDENING_OPT_OUT_ENV, "1")
+    request = _cookie_request(scheme)
+
+    written = StarletteResponse()
+    set_session_cookie(written, "a-token", request=request)
+    cleared = StarletteResponse()
+    clear_session_cookie(cleared, request)
+
+    set_name, set_attrs = _guards(written)
+    clear_name, clear_attrs = _guards(cleared)
+    # the positive control: the instrument DOES see Secure move with the scheme, so an all-passing
+    # comparison below cannot be two empty dicts agreeing with each other.
+    assert ("secure" in set_attrs) is (scheme == "https"), set_attrs
+    assert clear_name == set_name
+    assert clear_attrs == set_attrs
+
+
+@pytest.mark.parametrize(("scheme", "hardening"), _POSTURES)
+def test_oidc_flow_clear_carries_the_same_guards_as_the_set(
+    scheme: str, hardening: bool, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The same symmetry for the ADR 0142 flow cookie, whose clear runs on EVERY terminal callback --
+    so it is the more frequently emitted of the two deletions, not the rarer one."""
+    if hardening:
+        monkeypatch.delenv(BROWSER_HARDENING_OPT_OUT_ENV, raising=False)
+    else:
+        monkeypatch.setenv(BROWSER_HARDENING_OPT_OUT_ENV, "1")
+    request = _cookie_request(scheme)
+
+    written = StarletteResponse()
+    set_oidc_flow_cookie(written, "a-flow-id", request=request, max_age=300)
+    cleared = StarletteResponse()
+    clear_oidc_flow_cookie(cleared, request)
+
+    set_name, set_attrs = _guards(written)
+    clear_name, clear_attrs = _guards(cleared)
+    assert ("secure" in set_attrs) is (scheme == "https"), set_attrs
+    assert clear_name == set_name
+    assert clear_attrs == set_attrs
+
+
+def test_session_clear_follows_exposure_protected_not_only_the_wire_scheme() -> None:
+    """The ``tls_terminated_upstream`` topology ADR 0172 deliberately excludes: the engine speaks
+    plaintext to a declared proxy, so the wire scheme is http while the BROWSER's origin is https and
+    ``exposure_protected`` is true. The set writes Secure there; so must the clear."""
+    request = _cookie_request("http", exposure_protected=True)
+    written = StarletteResponse()
+    set_session_cookie(written, "a-token", request=request)
+    cleared = StarletteResponse()
+    clear_session_cookie(cleared, request)
+    assert "secure" in _guards(written)[1]  # control: the set really does key on the declaration
+    assert _guards(cleared) == _guards(written)
+
+
+async def test_opt_out_logout_over_https_still_deletes_with_secure(
+    engine: Engine, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """End to end through the real logout route, on the posture that used to lose three attributes:
+    the org opt-out over https."""
+    monkeypatch.setenv(BROWSER_HARDENING_OPT_OUT_ENV, "1")
+    service = await _service(engine)
+    await _add(service, "op", Role.OPERATOR)
+    async with _client(engine, service, scheme="https") as c:
+        await _login(c, "op")
+        out = await c.post("/ui/logout")
+        assert out.status_code == 303
+        set_cookie = out.headers["set-cookie"]
+        low = set_cookie.lower()
+        assert set_cookie.split("=", 1)[0] == "mf_session"  # opt-out keeps the bare name
+        assert "secure" in low and "httponly" in low and "samesite=strict" in low
+        # and the deletion really ended the session
+        assert (await c.get("/ui")).status_code in (302, 303, 401)