mrleo1nid/h-school
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reject a second live WebSocket for the same session name.

Browse Source 
Two tabs with the cookie already set never POST /api/session, so name-online on login did not cover the design rule. Claim the name under the same lock as the online check.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Leonid Pershin
2026-08-20 11:04:56 +03:00
co-authored by Cursor
parent d3396b5b8f
commit 1c3ae9ab7e
7 changed files with 219 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/protocol.md
+3 -2
View File
@@ -64,8 +64,9 @@ Returns `{ "userName": "Leo" }` when the cookie is valid, otherwise `401`.
Clears the session cookie. `204`.
The WebSocket at `/ws/game` uses the same cookie on upgrade. Without a valid cookie the server
closes the connection with a policy violation and never sends Welcome. Hello is unchanged
(version + locale only).
closes the connection with a policy violation and never sends Welcome. A second socket for a name
that already has a live connection is closed the same way; `POST /api/session` for that name
returns `409` `name-online`. Hello is unchanged (version + locale only).
### `GET /api/schools`