{ "ticket": "U29 #66", "label": "acceptance", "startedAt": "2026-10-26T16:45:13.899393+08:00", "rawLogs": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5", "input": [ "python3", "/Users/gaochao/Documents/面试/software-engineering-study/labs/security-browser/run.py" ], "sourceSha256": { "README.md": "7b9bb7130cdc88089052ce25be902c3cc3c93e006c3edf94a8b06dcafbe5007d", "pom.xml": "3ae331e7c72426f2dfd941f2146f754ad637051b1a041646e98c28befb0823b4", "run.py": "f91925464174efc5a1a821fbe03e8ec701c443d648829fd8d6fdfc82b9d031aa", "src/main/java/study/securitybrowser/LabEndpoints.java": "b464b8031d8ca5b8e0856b6d15da99313cd72982cb12a0f5c3af403cdf6b9840", "src/main/java/study/securitybrowser/SecurityBrowserLab.java": "c4bd7c79cfd7c10b99f3a7c1514ac106efce956626807313383a5a61032dee46", "src/main/java/study/securitybrowser/SecurityConfig.java": "2eff84ff82ec83712c2721b7f5478c21efeabbe23e2cadda046ce90d6b25cdf2", "src/main/java/study/securitybrowser/SyntheticCredentials.java": "7ce85e440da7150d141bda7768182ec167ee1aa32867fc0654309ada9cd1057f", "src/main/resources/application.properties": "71e63857a52c7195488792714604f3d85dc1d3e005024611341d698199da26fc" }, "results": [ { "name": "jdk", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/java", "-version" ], "exitCode": 0, "startedAt": "2026-10-26T16:45:13.902024+08:00", "finishedAt": "2026-10-26T16:45:14.036069+08:00", "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/jdk.log", "logSha256": "392524ee4bfbd5e1de98c543683d7fcaed057f7d69ef44a0d0a182de17816feb" }, { "name": "maven", "command": [ "mvn", "-version" ], "exitCode": 0, "startedAt": "2026-10-26T16:45:14.048038+08:00", "finishedAt": "2026-10-26T16:45:14.612539+08:00", "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/maven.log", "logSha256": "7df1d445c9ffb402337aefccb8c27c6109cd49aa2f7c1b992e9d462a2c08bf38" }, { "name": "package", "command": [ "mvn", "-B", "-ntp", "-q", "package" ], "exitCode": 0, "startedAt": "2026-10-26T16:45:14.612827+08:00", "finishedAt": "2026-10-26T16:45:16.041285+08:00", "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/package.log", "logSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "name": "dependency-tree", "command": [ "mvn", "-B", "-ntp", "dependency:tree" ], "exitCode": 0, "startedAt": "2026-10-26T16:45:16.060182+08:00", "finishedAt": "2026-10-26T16:45:17.213697+08:00", "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/dependency-tree.log", "logSha256": "63f9881ce5204d34406f4e03ba24f50dc26f1d92ca9f6e52211097c9f9b7e738" }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:18.409571+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "anonymousUser", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "AnonymousAuthenticationToken" }, "expectation": "public API", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 401, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:18.411187+08:00", "responseHeaders": { "WWW-Authenticate": "Basic realm=\"u29-api\"", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "anonymous API", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": "reader", "passwordKind": "synthetic-invalid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 401, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:18.577413+08:00", "responseHeaders": { "WWW-Authenticate": "Basic realm=\"u29-api\"", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "bad API credentials", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:18.633369+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "real Basic authentication", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/admin/report", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:18.688506+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "reader lacks ADMIN", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/admin/report", "basicUser": "operator", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:18.745934+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "operator", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "ADMIN succeeds", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.760451+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "fallback protects /browser/whoami", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/unlisted", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.762153+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "fallback protects /unlisted", "expectedStatus": 302 }, { "name": "chains", "status": "PASS", "startedAt": "2026-10-26T16:45:18.357562+08:00", "finishedAt": "2026-10-26T16:45:18.762198+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/prelogin", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.764526+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "marker": "lesson-u29" }, "expectation": "prelogin session", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "reader", "formPasswordKind": "synthetic-valid", "formFields": [ "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.766594+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "login requires CSRF", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "reader", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.767658+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "login rejects invalid CSRF", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.769925+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "reader", "formPasswordKind": "synthetic-invalid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 401, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.881235+08:00", "responseHeaders": { "X-Lab-Login-Failure": "bad-credentials", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login reader", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.882684+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "bad credentials never save context", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.883881+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.884855+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "reader", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:18.941394+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login reader", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.943301+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "lesson-u29", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "session restores context", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/unlisted", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.944610+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "lesson-u29", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "authenticated caller can use protected fallback route", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.946086+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "old fixation ID cannot authenticate", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/admin/report", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.947053+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "authenticated reader cannot access ADMIN", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/browser/change", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.947883+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "missing browser CSRF", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/browser/change", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.948538+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "invalid browser CSRF", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/browser/change", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.949135+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "login invalidates old CSRF token", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.950136+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/browser/change", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.951331+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "lesson-u29", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "valid browser CSRF", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.952002+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "logout missing CSRF is rejected", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.952839+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "logout invalid CSRF is rejected", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.955834+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "GET logout confirmation is safe", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.956916+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "lesson-u29", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "GET logout did not mutate session", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.957867+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:18.959197+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.960124+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "logout clears browser identity", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.961075+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "logout invalidates session server-side", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:18.961948+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "fresh request has no leaked context", "expectedStatus": 302 }, { "name": "browser-session", "status": "PASS", "startedAt": "2026-10-26T16:45:18.762204+08:00", "finishedAt": "2026-10-26T16:45:18.961978+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/credentials/legacy", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.964207+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "encoding": "noop", "upgrades": 0 }, "expectation": "public synthetic credential metadata", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.965214+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "legacy", "formPasswordKind": "synthetic-invalid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 401, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.966044+08:00", "responseHeaders": { "X-Lab-Login-Failure": "bad-credentials", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login legacy", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/credentials/legacy", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.966876+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "encoding": "noop", "upgrades": 0 }, "expectation": "public synthetic credential metadata", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:18.967731+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "legacy", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.025376+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login legacy", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/credentials/legacy", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.026673+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "encoding": "bcrypt", "upgrades": 1 }, "expectation": "public synthetic credential metadata", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.027817+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.028765+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.029780+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "legacy", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.084083+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login legacy", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/credentials/legacy", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.085300+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "encoding": "bcrypt", "upgrades": 1 }, "expectation": "public synthetic credential metadata", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.086420+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.087321+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "password-upgrade", "status": "PASS", "startedAt": "2026-10-26T16:45:18.961985+08:00", "finishedAt": "2026-10-26T16:45:19.087356+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.088824+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.143401+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.144760+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 409, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.200328+08:00", "responseHeaders": { "X-Lab-Login-Failure": "session-limit", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 409 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.201682+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "session-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "first session stays usable when second login is refused", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:19.202661+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "refused session has no saved authentication", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.203631+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.204515+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.205363+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.260266+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.261475+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "session-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "logout event frees registry slot", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.262428+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.263299+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.264152+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.319715+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.321411+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.322280+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "concurrency", "status": "PASS", "startedAt": "2026-10-26T16:45:19.087359+08:00", "finishedAt": "2026-10-26T16:45:19.322311+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.323634+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "remember-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "remember-me", "username" ], "rememberSelected": true, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.378880+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login remember-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.381201+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "remember-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "RememberMeAuthenticationToken" }, "expectation": "remember-me auto-login without session ID", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.382310+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.383256+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:19.384169+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "logged-out browser cannot auto-login", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:19.385246+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "server-side revocation rejects copied remember-me cookie", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.386361+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "remember-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "logout affects current session, not every active account session", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.387310+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.388056+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:19.389139+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" } }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:19.389886+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "malformed remember-me never authenticates", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.390750+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "remember-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "remember-me", "username" ], "rememberSelected": true, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.445772+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login remember-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.447039+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.447938+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "remember-me", "status": "PASS", "startedAt": "2026-10-26T16:45:19.322314+08:00", "finishedAt": "2026-10-26T16:45:19.447969+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.503317+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "Basic request identity", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.504229+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "anonymousUser", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "AnonymousAuthenticationToken" }, "expectation": "next request anonymous", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 401, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.504905+08:00", "responseHeaders": { "WWW-Authenticate": "Basic realm=\"u29-api\"", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "Basic authentication must be supplied on every request", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.506094+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "reader", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.560853+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login reader", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 401, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.561569+08:00", "responseHeaders": { "WWW-Authenticate": "Basic realm=\"u29-api\"", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "API cannot restore browser session authentication", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.562683+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.563459+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "XSRF-TOKEN" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.564941+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/api/change", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "XSRF-TOKEN" ], "submittedCsrf": "absent", "headers": {} }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.565521+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "Basic alone is not CSRF defense", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/api/change", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "XSRF-TOKEN" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.566090+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "invalid API CSRF", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "POST", "path": "/api/change", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.621060+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "reader", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "Basic plus valid CSRF", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "XSRF-TOKEN" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.622100+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/api/change", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "XSRF-TOKEN" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 401, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.622791+08:00", "responseHeaders": { "WWW-Authenticate": "Basic realm=\"u29-api\"", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "CSRF token alone cannot authenticate", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "POST", "path": "/api/change", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "XSRF-TOKEN" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.623417+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "token without matching CSRF cookie is rejected", "expectedStatus": 403 }, { "name": "stateless-csrf", "status": "PASS", "startedAt": "2026-10-26T16:45:19.447974+08:00", "finishedAt": "2026-10-26T16:45:19.623448+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.624329+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "absent", "name": "anonymousUser", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "AnonymousAuthenticationToken" }, "expectation": "default headers", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/prelogin", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.625211+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "marker": "lesson-u29" }, "expectation": "default headers", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": { "X-Forwarded-Proto": "https" } }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.625954+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "lesson-u29", "name": "anonymousUser", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "AnonymousAuthenticationToken" }, "expectation": "untrusted forwarded scheme", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "OPTIONS", "path": "/api/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": { "Origin": "https://classroom.example", "Access-Control-Request-Method": "POST", "Access-Control-Request-Headers": "authorization,content-type,x-xsrf-token" } }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.627314+08:00", "responseHeaders": { "Access-Control-Allow-Origin": "https://classroom.example", "Access-Control-Allow-Credentials": "true", "Access-Control-Allow-Methods": "GET,POST,OPTIONS", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "allowed unauthenticated preflight", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "OPTIONS", "path": "/api/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": { "Origin": "https://attacker.example", "Access-Control-Request-Method": "POST", "Access-Control-Request-Headers": "authorization,content-type,x-xsrf-token" } }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.628190+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "disallowed unauthenticated preflight", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "OPTIONS", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": { "Origin": "https://classroom.example", "Access-Control-Request-Method": "POST", "Access-Control-Request-Headers": "authorization,content-type,x-xsrf-token" } }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.628857+08:00", "responseHeaders": { "Access-Control-Allow-Origin": "https://classroom.example", "Access-Control-Allow-Credentials": "true", "Access-Control-Allow-Methods": "GET,POST,OPTIONS", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "allowed unauthenticated preflight", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "OPTIONS", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": { "Origin": "https://attacker.example", "Access-Control-Request-Method": "POST", "Access-Control-Request-Headers": "authorization,content-type,x-xsrf-token" } }, "status": 403, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.629439+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "disallowed unauthenticated preflight", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": { "Origin": "https://classroom.example" } }, "status": 401, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.630711+08:00", "responseHeaders": { "WWW-Authenticate": "Basic realm=\"u29-api\"", "Access-Control-Allow-Origin": "https://classroom.example", "Access-Control-Allow-Credentials": "true", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "allowed origin still needs authentication", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "POST", "path": "/api/change", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "XSRF-TOKEN" ], "submittedCsrf": "absent", "headers": { "Origin": "https://classroom.example" } }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.631530+08:00", "responseHeaders": { "Access-Control-Allow-Origin": "https://classroom.example", "Access-Control-Allow-Credentials": "true", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "allowed origin and Basic still require CSRF", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/admin/report", "basicUser": "reader", "passwordKind": "synthetic-valid", "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": { "Origin": "https://classroom.example" } }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.686421+08:00", "responseHeaders": { "Access-Control-Allow-Origin": "https://classroom.example", "Access-Control-Allow-Credentials": "true", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "allowed origin does not grant ADMIN role", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": { "Origin": "https://attacker.example" } }, "status": 403, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.687170+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "disallowed actual cross-origin request", "expectedStatus": 403 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open;probe=1", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 400, "chain": null, "location": null, "observedAt": "2026-10-26T16:45:19.687739+08:00", "responseHeaders": { "X-Lab-Rejected-By": "StrictHttpFirewall" }, "expectation": "malformed firewall path", "expectedStatus": 400 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open%3Bprobe=1", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 400, "chain": null, "location": null, "observedAt": "2026-10-26T16:45:19.688252+08:00", "responseHeaders": { "X-Lab-Rejected-By": "StrictHttpFirewall" }, "expectation": "malformed firewall path", "expectedStatus": 400 }, { "name": "http-request", "input": { "method": "GET", "path": "/api//open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 400, "chain": null, "location": null, "observedAt": "2026-10-26T16:45:19.688827+08:00", "responseHeaders": { "X-Lab-Rejected-By": "StrictHttpFirewall" }, "expectation": "malformed firewall path", "expectedStatus": 400 }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:19.689721+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "lesson-u29", "name": "anonymousUser", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "AnonymousAuthenticationToken" }, "expectation": "valid path recovers after malformed requests", "expectedStatus": 200 }, { "name": "defenses", "status": "PASS", "startedAt": "2026-10-26T16:45:19.623451+08:00", "finishedAt": "2026-10-26T16:45:19.689758+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.690897+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "remember-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "remember-me", "username" ], "rememberSelected": true, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.745698+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login remember-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/sensitive", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.746808+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "remember-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "password-authenticated session may access sensitive endpoint", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.747955+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "remember-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "RememberMeAuthenticationToken" }, "expectation": "remembered identity before sensitive operation", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/sensitive", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login", "observedAt": "2026-10-26T16:45:19.748678+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "remember-me cannot satisfy fullyAuthenticated", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.749433+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "remember-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/browser/whoami", "observedAt": "2026-10-26T16:45:19.804070+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login remember-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/sensitive", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.805140+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "preloginMarker": "null", "name": "remember-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken" }, "expectation": "password reauthentication restores sensitive access", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.805986+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.806768+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:19.807477+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57740/login?logout", "observedAt": "2026-10-26T16:45:19.808171+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "sensitive", "status": "PASS", "startedAt": "2026-10-26T16:45:19.689762+08:00", "finishedAt": "2026-10-26T16:45:19.808201+08:00" }, { "name": "tls-keypair", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/keytool", "-genkeypair", "-alias", "u29", "-keyalg", "RSA", "-keysize", "2048", "-validity", "2", "-dname", "CN=localhost", "-ext", "SAN=DNS:localhost,IP:127.0.0.1", "-storetype", "PKCS12", "-keystore", "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/tls-cr2h41lq/u29.p12", "-storepass:env", "U29_TLS_PASSWORD", "-noprompt" ], "exitCode": 0, "startedAt": "2026-10-26T16:45:19.847547+08:00", "finishedAt": "2026-10-26T16:45:20.251520+08:00", "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/tls-keypair.log", "logSha256": "b684d13ee21c7537cb2602673c228ddcd3c689b9d940b7f46d8f0309310a49be" }, { "name": "tls-certificate", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/keytool", "-exportcert", "-rfc", "-alias", "u29", "-keystore", "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/tls-cr2h41lq/u29.p12", "-storepass:env", "U29_TLS_PASSWORD", "-file", "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/tls-cr2h41lq/u29.pem" ], "exitCode": 0, "startedAt": "2026-10-26T16:45:20.251766+08:00", "finishedAt": "2026-10-26T16:45:20.433161+08:00", "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/tls-certificate.log", "logSha256": "62085bbd73964b30c8a6979bda2211ec8c825dfbe927e8331dfae665c1025579" }, { "name": "http-request", "input": { "method": "GET", "path": "/api/open", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "api", "location": null, "observedAt": "2026-10-26T16:45:21.815652+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'", "Strict-Transport-Security": "max-age=31536000 ; includeSubDomains" }, "responseBody": { "name": "anonymousUser", "requestThread": "https-jsse-nio-127.0.0.1-auto-1-exec-1", "mechanism": "AnonymousAuthenticationToken", "preloginMarker": "absent" }, "expectation": "verified real TLS request", "expectedStatus": 200 }, { "name": "secure-hsts", "path": "/api/open", "tlsVerification": "run-specific trusted certificate + hostname", "observed": "max-age=31536000 ; includeSubDomains" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/prelogin", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:21.837003+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'", "Strict-Transport-Security": "max-age=31536000 ; includeSubDomains" }, "responseBody": { "marker": "lesson-u29" }, "expectation": "verified real TLS request", "expectedStatus": 200 }, { "name": "secure-hsts", "path": "/browser/prelogin", "tlsVerification": "run-specific trusted certificate + hostname", "observed": "max-age=31536000 ; includeSubDomains" }, { "name": "tls-material-cleanup", "deleted": true }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:23.086909+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/browser/whoami", "observedAt": "2026-10-26T16:45:23.199725+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:23.201707+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/browser/session/expire-soon", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:23.204246+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "maxInactiveSeconds": 1 }, "expectation": "shorten own teaching session to one second", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/login", "observedAt": "2026-10-26T16:45:25.214860+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "expired real container session cannot restore identity", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/login", "observedAt": "2026-10-26T16:45:25.217240+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "expired session ID replay denied", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:25.219410+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/browser/whoami", "observedAt": "2026-10-26T16:45:25.291889+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:25.293862+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/login?logout", "observedAt": "2026-10-26T16:45:25.295929+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:25.297933+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "remember-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "remember-me", "username" ], "rememberSelected": true, "cookieNames": [ "JSESSIONID", "remember-me" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/browser/whoami", "observedAt": "2026-10-26T16:45:25.360443+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login remember-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/login", "observedAt": "2026-10-26T16:45:28.375816+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "expired persistent remember-me token cannot auto-login", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:28.383573+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "name": "remember-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1", "mechanism": "UsernamePasswordAuthenticationToken", "preloginMarker": "null" }, "expectation": "remember-me and session have independent lifetimes", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:28.386966+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57870/login?logout", "observedAt": "2026-10-26T16:45:28.389291+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "lifetimes-observed", "elapsedSeconds": 5.185, "sessionMaxInactiveSeconds": 1, "rememberValiditySeconds": 2, "expiredSession": 302, "expiredRememberReplay": 302, "liveInteractiveSession": 200, "registrySlotAfterSessionExpiry": "login succeeded" }, { "name": "lifetimes", "status": "PASS", "finishedAt": "2026-10-26T16:45:28.428610+08:00" }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.739253+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57904/browser/whoami", "observedAt": "2026-10-26T16:45:29.857098+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.858852+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57904/browser/whoami", "observedAt": "2026-10-26T16:45:29.918208+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.920458+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": { "mechanism": "UsernamePasswordAuthenticationToken", "preloginMarker": "null", "name": "session-user", "requestThread": "http-nio-127.0.0.1-auto-1-exec-1" }, "expectation": "new session succeeds in expire-old mode", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "absent", "headers": {} }, "status": 401, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.922435+08:00", "responseHeaders": { "X-Lab-Session-State": "expired", "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "old session expires on its next request", "expectedStatus": 401 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/whoami", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57904/login", "observedAt": "2026-10-26T16:45:29.924906+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "expired session invalidated and context cleared", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.926329+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57904/login?logout", "observedAt": "2026-10-26T16:45:29.927542+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.928920+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/login", "basicUser": null, "passwordKind": null, "formUser": "session-user", "formPasswordKind": "synthetic-valid", "formFields": [ "_csrf", "password", "username" ], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57904/browser/whoami", "observedAt": "2026-10-26T16:45:29.987439+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "form login session-user", "expectedStatus": 302 }, { "name": "http-request", "input": { "method": "GET", "path": "/browser/csrf", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [], "rememberSelected": false, "cookieNames": [ "JSESSIONID" ], "submittedCsrf": "absent", "headers": {} }, "status": 200, "chain": "browser", "location": null, "observedAt": "2026-10-26T16:45:29.988866+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "responseBody": {}, "expectation": "fetch CSRF token", "expectedStatus": 200 }, { "name": "http-request", "input": { "method": "POST", "path": "/logout", "basicUser": null, "passwordKind": null, "formUser": null, "formPasswordKind": null, "formFields": [ "_csrf" ], "rememberSelected": false, "cookieNames": [], "submittedCsrf": "present-redacted", "headers": {} }, "status": 302, "chain": "browser", "location": "http://127.0.0.1:57904/login?logout", "observedAt": "2026-10-26T16:45:29.990074+08:00", "responseHeaders": { "X-Content-Type-Options": "nosniff", "X-Frame-Options": "DENY", "X-XSS-Protection": "0", "Cache-Control": "no-cache, no-store, max-age=0, must-revalidate", "Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; style-src 'self' 'unsafe-inline'" }, "expectation": "protected logout", "expectedStatus": 302 }, { "name": "expire-old", "status": "PASS", "finishedAt": "2026-10-26T16:45:30.028037+08:00" } ], "processes": [ { "name": "http", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/java", "-jar", "/Users/gaochao/Documents/面试/software-engineering-study/labs/security-browser/target/security-browser-1.jar" ], "startedAt": "2026-10-26T16:45:17.213976+08:00", "finishedAt": "2026-10-26T16:45:19.847146+08:00", "exitCode": 143, "reaped": true, "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/http-server.log", "logSha256": "6028c3692eb2a1df808f46b7737c4664380ed80684acd334a6ab48151622a7df" }, { "name": "https", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/java", "-jar", "/Users/gaochao/Documents/面试/software-engineering-study/labs/security-browser/target/security-browser-1.jar", "--server.ssl.enabled=true", "--server.ssl.key-store=/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/tls-cr2h41lq/u29.p12", "--server.ssl.key-store-type=PKCS12", "--server.ssl.key-alias=u29" ], "startedAt": "2026-10-26T16:45:20.433644+08:00", "finishedAt": "2026-10-26T16:45:21.875971+08:00", "exitCode": 143, "reaped": true, "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/https-server.log", "logSha256": "a7a350012a99b40d00117bc5aa37759c75fcef2ca674df50cd64289b541a472f" }, { "name": "expiry", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/java", "-jar", "/Users/gaochao/Documents/面试/software-engineering-study/labs/security-browser/target/security-browser-1.jar", "--lab.remember-seconds=2" ], "startedAt": "2026-10-26T16:45:21.876539+08:00", "finishedAt": "2026-10-26T16:45:28.428359+08:00", "exitCode": 143, "reaped": true, "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/expiry-server.log", "logSha256": "ab72d5f3560076960655c9de0f1dfcd499ca2b7fffff1e1e5d1b2b3d7c892ef5" }, { "name": "expire-old", "command": [ "/Library/Java/JavaVirtualMachines/liberica-jdk-21.jdk/Contents/Home/bin/java", "-jar", "/Users/gaochao/Documents/面试/software-engineering-study/labs/security-browser/target/security-browser-1.jar", "--lab.prevent-new-login=false" ], "startedAt": "2026-10-26T16:45:28.428665+08:00", "finishedAt": "2026-10-26T16:45:30.027834+08:00", "exitCode": 143, "reaped": true, "log": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u29/run-22n02nk5/expire-old-server.log", "logSha256": "caf3657da646732cd50317ca2442357ca679b545bafdad7722e129702f0055f3" } ], "environment": { "os": "macOS-27.0.1-arm64-arm-64bit", "arch": "arm64", "jdk": "openjdk version \"21.0.11\" 2026-04-21 LTS\nOpenJDK Runtime Environment (build 21.0.11+11-LTS)\nOpenJDK 64-Bit Server VM (build 21.0.11+11-LTS, mixed mode, sharing)", "boot": "4.0.9", "security": "7.0.8", "framework": "7.0.10", "python": "3.9.6" }, "jarSha256": "205902f4b1daeae8d0791265f8249b7be67e588899be1565a98c4a9698351330", "packagedLibraries": [ "commons-logging-1.3.6.jar", "jackson-annotations-2.21.jar", "jackson-core-3.1.7.jar", "jackson-databind-3.1.7.jar", "jakarta.annotation-api-3.0.0.jar", "jspecify-1.0.1.jar", "jul-to-slf4j-2.0.20.jar", "log4j-api-2.25.5.jar", "log4j-to-slf4j-2.25.5.jar", "logback-classic-1.5.38.jar", "logback-core-1.5.38.jar", "micrometer-commons-1.16.8.jar", "micrometer-observation-1.16.8.jar", "slf4j-api-2.0.20.jar", "snakeyaml-2.5.jar", "spring-aop-7.0.10.jar", "spring-beans-7.0.10.jar", "spring-boot-4.0.9.jar", "spring-boot-autoconfigure-4.0.9.jar", "spring-boot-http-converter-4.0.9.jar", "spring-boot-jackson-4.0.9.jar", "spring-boot-jarmode-tools-4.0.9.jar", "spring-boot-security-4.0.9.jar", "spring-boot-servlet-4.0.9.jar", "spring-boot-tomcat-4.0.9.jar", "spring-boot-web-server-4.0.9.jar", "spring-boot-webmvc-4.0.9.jar", "spring-context-7.0.10.jar", "spring-core-7.0.10.jar", "spring-expression-7.0.10.jar", "spring-security-config-7.0.8.jar", "spring-security-core-7.0.8.jar", "spring-security-crypto-7.0.8.jar", "spring-security-web-7.0.8.jar", "spring-tx-7.0.10.jar", "spring-web-7.0.10.jar", "spring-webmvc-7.0.10.jar", "tomcat-embed-core-11.0.27.jar", "tomcat-embed-el-11.0.27.jar", "tomcat-embed-websocket-11.0.27.jar" ], "cleanup": { "allChildProcessesReaped": true, "temporaryTlsMaterialDeleted": true, "syntheticPasswordAbsentFromServerLogs": true, "retained": "own per-run logs, Maven target, redacted evidence; no external service changes" }, "exitCode": 0, "finishedAt": "2026-10-26T16:45:30.028302+08:00" }