feat(*): Revocation store for stateless cookie sessions - #209
Merged
Conversation
Redis Token Revocation Store
Drop redundant open tests and post-open revocation mutation; exercise revocation via redis.mode and real Redis integration where possible. Co-authored-by: Cursor <cursoragent@cursor.com>
Reorder happy-path tests first, dedupe overlap, and group fail-mode coverage.
3 tasks
Hockenba
changed the title
Hockenba
changed the title
bungle
approved these changes
Aug 24, 2026
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continues #208 (source branch changed; see comment there).
Summary
Adds optional storage-backed session revocation for stateless (cookie) sessions.
session:open, check whether the session ID is in the denylist.session:destroy, write a lightweight sentinel with TTL matching remaining session lifetime (no session payload stored).Revocation is only available when
storageisnilor"cookie". Select a backend explicitly withrevocation = "dshm","file","memcached","mysql","postgres","redis", or"shm"(custom storage modules and pre-builtset/gettables are also supported). Backends use their normal configuration section. Leaverevocationunset or setrevocation = falseto disable.revocation_fail_modedefaults to"open"(store unreachable → treat as not revoked; destroy still clears the cookie)."closed"rejects open/destroy when the store is unavailable.Revocation applies to full
destroy/ single-audiencelogout. It does not apply tosession:saverotation or partial multi-audience logout.Consumer: apache/apisix#13651.
Test plan
make unit/busted spec/06-revocation-1_spec.lua spec/07-revocation-2_spec.luaspec/06-revocation-1_spec.luafile,shm,redis,memcachedrevocation=falsespec/07-revocation-2_spec.luamysql,postgres, Redis Sentinel/Cluster,dshmrevocation_fail_mode, invalid revocation type/value, invalid fail mode