Session Cookies Done Right

This post started as a note to my future self. Every few months I relearn the same lessons about supply chain security, so this time I'm writing them down.

When we finally measured, the numbers were worse than anyone guessed. Around 21% of the time spent on a typical change went into working around supply chain security rather than building anything.

What was going wrong

Most of the complexity was accidental. Over the years we'd layered three different approaches to supply chain security on top of each other, and each one made sense at the time.

We had good intentions. We even had a document describing how supply chain security should work. The trouble was that the document and the code had quietly gone their separate ways.

How it works

The fix turned out to be smaller than expected. Instead of adding another layer, we removed one and leaned on what Sigstore already gives you out of the box.

The core of it looks like this:

cosign sign --yes ghcr.io/acme/api@sha256:3f1c...
cosign verify \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/acme/api@sha256:3f1c...

This alone let us delete a surprising amount of code elsewhere in the project.

A few things that helped along the way:

• Pair on the first few changes so the knowledge doesn't live in one head.
• Agree on what "done" means before the first pull request.
• Make the default the safe choice, not just the documented one.

Where this breaks down

There are cases where this falls apart. If your team is very small or your traffic is very spiky, the extra moving parts may not pay for themselves.

None of this is free. The new approach is a bit more verbose, and newcomers occasionally ask why we don't just use OpenSSL for everything. That's a fair question with a boring answer: we tried, and it made supply chain security harder to reason about.

Closing thoughts

If you take one thing away from this, let it be this: supply chain security is a design decision, not a cleanup task. Make it early and make it on purpose.