security(session): do not expose 'sid' from OIDC

prefer exposing origin of the session: passwod, opaque, magic_link, oidc, unknown
2026-08-09 15:14:59 +02:00
parent c28eb9b42e
commit 763ee82028
8 changed files with 225 additions and 17 deletions
@@ -785,7 +785,13 @@ pub async fn login_ke3(
    // we don't want to have flipped the migration flag for a user
    // whose login didn't actually complete.
    let session = auth
-        .mint_session_for_authenticated_user(user, dto.dpop_jkt, Some(client_ip), user_agent)
+        .mint_session_for_authenticated_user(
+            user,
+            dto.dpop_jkt,
+            Some(client_ip),
+            user_agent,
+            crate::domain::entities::session::SessionOrigin::Opaque,
+        )
        .await
        .map_err(AppError::from)?;