Add session-based UI authentication with server-side logout invalidation#18933

Open

Akanksha-kedia wants to merge 10 commits into

apache:masterfrom

Akanksha-kedia:feat/session-based-ui-auth

Commits on Jul 12, 2026

Add session-based UI authentication with proper server-side logout invalidation
Akanksha-kedia
committed
fix: resolve 11 checkstyle violations in pinot-controller

Akanksha-kedia
and
claude
committed
fix: fix compilation errors in session auth classes

Akanksha-kedia
and
claude
committed
Fix auth bypass in session mode: inject credentials instead of early return

Akanksha-kedia
and
claude
committed
Fix three security issues from review: CORS, login auth, timeseries broker auth

Akanksha-kedia
and
claude
committed
Refactor SessionManager into interface with InMemorySessionManager default impl

Akanksha-kedia
and
claude
committed
ci: trigger re-run
Akanksha-kedia
committed
fix(session-auth): fix Authorization header stripping for non-session API clients
Akanksha-kedia
committed

Commits on Jul 13, 2026

fix(session-auth): align cookie and server session expiry; document sticky-session requirement
Akanksha-kedia
committed

Commits on Jul 14, 2026

fix(session-auth): address review comments — atomic rotation, cache factory, escapeJson, timer leak
Akanksha-kedia
committed