.tip

Mar 16, 2026 · one of the small things

ssh -L reaches a database that is only on the private network

The database allows connections from the bastion only. Tunnel through it and your local client thinks the database is on localhost.

ssh -N -L 5433:db.internal:5432 bastion
psql "host=localhost port=5433 dbname=app"

-N runs no remote command, just the tunnel. Put it in ~/.ssh/config as a LocalForward line and it is one word.

shelloperations

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close