feat(gdpr): HttpOnly author-token cookie (PR3 of #6701) - #7548

Merged

JohnMcLear merged 10 commits into

feat-gdpr-anon-identity

May 3, 2026

Commits on Apr 19, 2026

docs: PR3 GDPR anonymous identity hardening design spec
JohnMcLear
committed
f123e37
docs: PR3 GDPR anon identity implementation plan
JohnMcLear
committed
4456eb6
feat(gdpr): ensureAuthorTokenCookie helper — HttpOnly server-set author token
JohnMcLear
committed
7da82c6
feat(gdpr): set HttpOnly author-token cookie from the pad routes
JohnMcLear
committed
232df62
feat(gdpr): read author token from cookie first, keep message.token fallback
JohnMcLear
committed
b50b7d3
feat(gdpr): stop generating the author token client-side
JohnMcLear
committed
641a9af
test(gdpr): server sets + reuses the HttpOnly author-token cookie
JohnMcLear
committed
b0b83cc
fix+test(gdpr): parse token cookie from handshake Cookie header
JohnMcLear
committed
c685bb4
docs(gdpr): token cookie is now HttpOnly + server-set
JohnMcLear
committed
f842ead
fix(gdpr): close two HttpOnly token bypasses

JohnMcLear
and
claude
committed
89fde85