Resilient session checks for existing integrations
Verified application-server session checks gain shared sustained and burst admission, bounded overlap combining and clear diagnostics. Existing SDK integrations receive the service-side fix without upgrading, while live session verification and revocation remain authoritative.
What changed
- Verified signed session checks use continuous admission of 20 checks per second per project/session with 120 immediate burst credits, shared through PostgreSQL across service replicas.
- Each caller verifies its request and consumes its own admission. Identical checks can combine while admission is pending; each group closes before the live native lookup starts. Responses and cookie headers are independent.
- No completed authentication result is cached. New arrivals cannot join an older authority read, and failures do not grant authentication. Password, MFA, recovery and invalid-request protections retain their existing paths.
- HTTP 429 retains Retry-After and adds ALLAUTH_SESSION_CHECK_RATE_LIMITED. Credential-free diagnostics distinguish rate refusal, invalid sessions, verification failure and service failure.
- The unchanged 1.0.0 proxy passed local multi-user and two-replica prevention tests, including 384 clustered checks and 2,640 checks over a full sustained minute. These fixtures are compatibility evidence, not a production capacity claim.
Release provenance
release
Service-side admission, coordination, revocation, isolation, failure-recovery and unchanged-archive compatibility regressions passed locally. Deployment and production integration verification are recorded separately in the release receipt.
Reviewed package files: session-introspection.ts, session-introspection-admission.ts, session-check-coordinator.ts, SESSION_INTROSPECTION_VALIDATION.md