A site outside the console cannot tell whether its visitor is signed in #6

New Issue

2026-09-21T07:18:03Z

cgalo5758 commented

2026-09-21 07:18:03 +00:00

What a person cannot do today

Show a visitor the right call to action on a page the console does not serve. A deployment's own website or forum cannot ask whether the visitor has a console session, so it shows the same buttons to everyone.

What they should be able to do

Ask the console from the browser whether the visitor is signed in and get a yes or no, from an allowlisted origin, without exposing anything else about the session.

Why it matters

The front door of a deployment is usually a separate site, and a stranger and a member should not see the same door.

Where

The authentication layer (a status route, a cross-origin allowlist, a session cookie scoped so the parent domain can present it).

Done when

An allowlisted origin can fetch a status that says whether the visitor is signed in, and nothing more is disclosed.

## What a person cannot do today Show a visitor the right call to action on a page the console does not serve. A deployment's own website or forum cannot ask whether the visitor has a console session, so it shows the same buttons to everyone. ## What they should be able to do Ask the console from the browser whether the visitor is signed in and get a yes or no, from an allowlisted origin, without exposing anything else about the session. ## Why it matters The front door of a deployment is usually a separate site, and a stranger and a member should not see the same door. ## Where The authentication layer (a status route, a cross-origin allowlist, a session cookie scoped so the parent domain can present it). ## Done when An allowlisted origin can fetch a status that says whether the visitor is signed in, and nothing more is disclosed.

cgalo5758 added the

kind

enhancement

area/identity security labels 2026-09-21 07:18:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#6