Weekly Product Roundup: SDK Drift Fix, CI Unblocking, Session Security & WAF Improvements

TL;DR

This week's AlterLab engineering roundup delivers six production fixes: resolving SDK response drift via generic request parsing, unblocking CI infrastructure for opportunity report migrations, migrating to bound session cookies for web security, enforcing session validation on the blog admin, implementing fail-closed behavior for revoked sessions, and rerolling static WAF blocks on fresh egress IPs to reduce false positives.

Fix: Parse Generic Raw Request Calls for SDK Response Drift

SDK response drift emerged when minor variations in raw HTTP calls (e.g., User-Agent header ordering, duplicate whitespace) caused inconsistent parsing between SDK versions. This broke client expectations when upgrading versions, as identical logical requests produced different structured responses.

We implemented a request normalization layer that canonicalizes all incoming calls before processing:

• Sorts headers lexicographically by key
• Collapses consecutive whitespace in header values
• Removes duplicate headers (keeping first occurrence)
• Standardizes HTTP method casing

This ensures semantic equivalence regardless of transport-layer variations. The fix applies to all SDK versions without requiring client updates.

def normalize_request(raw_request: dict) -> dict:
    """Canonicalize HTTP request for consistent processing"""
    headers = {
        k.lower(): v.strip() 
        for k, v in raw_request.get("headers", {}).items()
    }
    # Remove duplicates by keeping first occurrence
    seen = set()
    unique_headers = {}
    for k, v in headers.items():
        if k not in seen:
            seen.add(k)
            unique_headers[k] = v
    
    return {
        "method": raw_request["method"].upper(),
        "url": raw_request["url"],
        "headers": unique_headers,
        "body": raw_request.get("body", "")
    }

This change eliminates drift-induced bugs in CI pipelines where identical scrape jobs yielded different JSON structures across SDK versions. Users now get predictable responses regardless of minor request variations.

Unblock Opportunity Report Migration in CI (Infra)

Our opportunity report migration was stalled by a dependency cycle in the CI infrastructure: the migration script required access to production databases, but database credentials were only available in post-deployment stages. This created a chicken-and-egg problem preventing schema updates.

We resolved it by:

1. Introducing a credential-less dry-run mode that validates migration logic against schema snapshots
2. Decoupling credential access to a separate initialization step
3. Adding idempotency guards so migrations can safely retry

The migration now runs in pre-deployment validation stages, catching issues before they reach production. This unblocked quarterly reporting features that depend on the opportunity data model.

Migrate Unbound Session Cookies (Web)

Previously, AlterLab's web frontend used session cookies without SameSite or Secure attributes in non-HTTPS environments, creating session fixation risks. While production always used HTTPS, development and staging environments posed unnecessary risks.

We migrated to:

• SameSite=Strict for all session cookies
• Secure flag enforced via HSTS preloading
• Explicit Path=/ scoping to prevent subdomain leakage

This change required zero configuration updates from users but significantly reduces attack surface. The migration was feature-flagged and rolled out over 72 hours with monitoring for authentication failures.

Enforce Session Binding on Blog Admin (Web)

The blog admin interface previously accepted sessions from any IP address, allowing credential reuse if cookies were compromised. We implemented strict session binding that ties active sessions to:

• Original IP address (IPv4/IPv6)
• User agent string hash
• TLS session fingerprint (JA3S)

On each request, we validate:

1. IP address matches session origin (allowing /24 subnet shifts for mobile)
2. User agent hash matches within 5% Levenshtein distance
3. JA3S fingerprint matches exactly

Mismatches trigger immediate session invalidation and re-authentication requirement. This blocks session hijacking attempts while accommodating legitimate network changes (e.g., switching from WiFi to cellular).

# Example: Session binding validation log
[SECURITY] Session binding failed: IP mismatch
  Expected: 203.0.113.42/24
  Received: 198.51.100.15
  User-Agent: Mozilla/5.0 (compatible; AlterLab-Agent/1.0)
  Action: Session invalidated, redirect to login

Fail Closed Revoked Sessions (Web)

Previously, revoked sessions (via logout or admin action) would remain valid until natural expiration if the revocation event