S5 Origin — Weak Session Cookie Baseline

PoC only: This origin intentionally issues a weak PHPSESSID cookie in the normal/before state. The cookie is exposed to the browser with no Secure, HttpOnly, or SameSite attributes. In the real flow the S5 capability Worker (hosted at s5.thecompany-lab.com) vaults the session cookies and issues a hardened __rs_sid cookie instead.

Direct hostname: s5-origin.thecompany-lab.com
Capability hostname: s5.thecompany-lab.com

Cookie contract consumed by the S5 capability Worker

KindNamesCapability behavior
Session (vaulted) PHPSESSID, AUTHTOKEN Strip from client response; persist mapping; rebuild on origin request.
Non-session (pass-through) theme Leave untouched in both directions.

Routes exposed by this origin

MethodPathPurpose
GET /, /demo This page (normal/before state explanation)
POST /login Issue weak session cookies (semantic entry point)
GET /issue Issue weak session cookies (test convenience)
GET /whoami Echo received session/non-session cookies and raw-client flag
GET /rotate Issue new origin session ids (origin-driven rotation)
GET /logout Delete origin session cookies

Expected Set-Cookie / Cookie shapes

Issue response headers (weak, no protection):

Set-Cookie: PHPSESSID=<weak-value>; Path=/
Set-Cookie: AUTHTOKEN=<weak-value>; Path=/
Set-Cookie: theme=dark; Path=/

Authenticated request rebuilt by the capability (raw client session names are stripped):

Cookie: PHPSESSID=<vaulted-value>; AUTHTOKEN=<vaulted-value>; theme=dark

Logout / deletion response headers:

Set-Cookie: PHPSESSID=; Path=/; Max-Age=0
Set-Cookie: AUTHTOKEN=; Path=/; Max-Age=0

Note: No request or response cookie value is logged by this origin. Echoing in the /whoami response body is intentional only for PoC contract verification.