Use cookies and authorization safely

An opaque session cookie identifies the user, and the bookmark owner is checked before update or deletion. This is a small part of a typed bookmarks API built with Hono, tested in memory, and deployed once to Node and once to Cloudflare Workers, but the boundary it creates affects everything that follows.

Cookie helpers simplify parsing and serialization; they do not replace session design, CSRF protection, or authorization. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to store trusted roles in a script-readable cookie and skip ownership checks after login. It makes later failures harder to locate. Instead, use secure cookie attributes, keep authority server-side, and check the resource action on every request. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Reject malformed or unauthorized requests at the boundary and keep domain code independent of raw request parsing. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Test another user’s bookmark, a missing session, a revoked session, and a state-changing cross-site request. Hand the result to someone else and see whether the behavior is clear without an oral explanation.