[PR #390] [CLOSED] fix: enable session_id_context for HTTPS server #437

New issue

Closed

opened 2026-10-15 13:00:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:00:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/wolf/pull/390
Author: @BenSmith
Created: 4/12/2026
Status: ❌ Closed

Base: stable ← Head: fix/session-id-context

📝 Commits (3)

2a582c5 fix: enable session_id_context for HTTPS server
5806a65 test: HTTPS server must allow session resumption with client cert
28c5945 Merge pull request #1 from BenSmith/test/https-session-resumption

📊 Changes

3 files changed (+136 additions, -2 deletions)

View changed files

📝 src/moonlight-server/rest/rest.hpp (+1 -1)
📝 tests/CMakeLists.txt (+2 -1)
➕ tests/testHTTPS.cpp (+133 -0)

📄 Description

The set_session_id_context member of Server<HTTPS> defaults to false in rest.hpp, leaving the after_bind() override's call to SSL_CTX_set_session_id_context() as dead code. Wolf's HTTPS server therefore runs with no session ID context set on its SSL_CTX.

OpenSSL only enforces this on session-resumption-capable client cert handshakes. The first HTTPS request from a new client (the /pair challenge) goes through fine -- no resumption attempt. Every subsequent request from the same client (/applist, /serverinfo, launch, etc.) attempts session resumption, OpenSSL checks for a session ID context, finds none, and refuses with:

HTTPS error during request at error code: 167772437 - session id context uninitialized (SSL routines)

which surfaces on the client as QNetworkReply::SslHandshakeFailedError (or equivalent on other clients). The pairing succeeds but every subsequent operation fails.

Setting the default to true makes after_bind() do its job. Wolf's chosen session_id_context value (port + reversed address) works as a per-server unique tag.

Editing to add: I used AI tooling to help track this down.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/wolf/pull/390 **Author:** [@BenSmith](https://github.com/BenSmith) **Created:** 4/12/2026 **Status:** ❌ Closed **Base:** `stable` ← **Head:** `fix/session-id-context` --- ### 📝 Commits (3) - [`2a582c5`](https://github.com/games-on-whales/wolf/commit/2a582c5c359920e18266b4fa82bb44c5366dc17e) fix: enable session_id_context for HTTPS server - [`5806a65`](https://github.com/games-on-whales/wolf/commit/5806a6581aa36b91c77c7e17d497179570017f9b) test: HTTPS server must allow session resumption with client cert - [`28c5945`](https://github.com/games-on-whales/wolf/commit/28c5945efb839f8020507070ee80195a3cdb6746) Merge pull request #1 from BenSmith/test/https-session-resumption ### 📊 Changes **3 files changed** (+136 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/moonlight-server/rest/rest.hpp` (+1 -1) 📝 `tests/CMakeLists.txt` (+2 -1) ➕ `tests/testHTTPS.cpp` (+133 -0) </details> ### 📄 Description The `set_session_id_context` member of `Server<HTTPS>` defaults to false in rest.hpp, leaving the `after_bind() `override's call to `SSL_CTX_set_session_id_context()` as dead code. Wolf's HTTPS server therefore runs with no session ID context set on its `SSL_CTX`. OpenSSL only enforces this on session-resumption-capable client cert handshakes. The first HTTPS request from a new client (the `/pair` challenge) goes through fine -- no resumption attempt. Every subsequent request from the same client (`/applist`, `/serverinfo`, `launch`, etc.) attempts session resumption, OpenSSL checks for a session ID context, finds none, and refuses with: > HTTPS error during request at <path> error code: 167772437 - session id context uninitialized (SSL routines) which surfaces on the client as `QNetworkReply::SslHandshakeFailedError` (or equivalent on other clients). The pairing succeeds but every subsequent operation fails. Setting the default to `true` makes `after_bind()` do its job. Wolf's chosen `session_id_context` value (port + reversed address) works as a per-server unique tag. Editing to add: I used AI tooling to help track this down. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 13:00:33 +00:00