Use case indexS5 · Cookie vault verification · browser + command line verification

S5 — Session cookie vault

Origin issues weak PHPSESSID / AUTHTOKEN. This host vaults them and gives the browser only opaque __rs_sid (Secure; HttpOnly; SameSite=Strict).

Direct originRewrite Worker
Open s5-origin…/ s5…/ (this page: /__rs/demo)
Browser cookies Weak origin session names visible Only __rs_sid — never origin session names

1. Browser verification

Use these controls on this host. Watch DevTools → Application → Cookies for s5.thecompany-lab.com.

Live response

Click “Issue session” to begin…

After issue: jar should show __rs_sid only. Whoami JSON should include origin session values under received while the browser never stores those names.

2. Compare origin (before)

Origin /issue Origin /whoami

On the origin host the browser receives weak PHPSESSID/AUTHTOKEN directly.

3. Command-line verification (copy and run)

# Capability path
rm -f /tmp/s5-cap.txt
curl -sS -c /tmp/s5-cap.txt -b /tmp/s5-cap.txt -D - \
  https://s5.thecompany-lab.com/issue -o /tmp/s5-issue.json
# Expect Set-Cookie: __rs_sid=…; Secure; HttpOnly; SameSite=Strict
# Expect NO PHPSESSID/AUTHTOKEN Set-Cookie to the client
cat /tmp/s5-cap.txt
curl -sS -c /tmp/s5-cap.txt -b /tmp/s5-cap.txt \
  https://s5.thecompany-lab.com/whoami | jq .
curl -sS -c /tmp/s5-cap.txt -b /tmp/s5-cap.txt \
  https://s5.thecompany-lab.com/rotate | jq .
curl -sS -c /tmp/s5-cap.txt -b /tmp/s5-cap.txt -D - \
  https://s5.thecompany-lab.com/logout -o /dev/null

# Origin baseline (weak cookies land in the jar)
rm -f /tmp/s5-orig.txt
curl -sS -c /tmp/s5-orig.txt -D - https://s5-origin.thecompany-lab.com/issue -o /dev/null
cat /tmp/s5-orig.txt

Pass criteria