F-36: Operator credential and session cookie travel in cleartext #39

Severity: MEDIUM · Effort: Small (decision) · Batch: 5 · Status: Facts recorded in #21 (bf65c15); the decision itself is open, and is the owner's to make

Found in the second full review of the firmware. Recorded with the rest of the pass (F-19…F-44) in docs/REVIEW_REMEDIATION_PLAN_2.md, which is where its status is kept.

Description

The login POST, the session cookie and the control plane travel over plain HTTP and WS.
SESSION_TTL_MS is 30 days with sliding refresh, so a cookie captured on the layout WiFi
drives trains for a month. Storing it in plaintext NVS is the accepted F-18 risk; nothing
records a decision about cleartext on the wire.

Plan

Record the decision in CLAUDE.md's transport section. If TLS is wanted, size it with
idf.py size first against the flash budget.

What batch 5 measured

• Flash is not the obstacle. The image already carries mbedTLS: libmbedcrypto 79 KB,
  libmbedtls 30 KB and libmbedx509 9 KB, pulled in by esp_websocket_client's SSL
  transport and esp_http_client. A build with CONFIG_ESP_HTTP_CLIENT_ENABLE_HTTPS=n was
  only 528 bytes smaller, because the WebSocket client links it anyway. So https/wss
  would add little beyond a CA or pinned certificate — and, conversely, staying cleartext
  gives none of that flash back.
• Heap is the device-side cost. With this build's mbedTLS settings (16 KB input record
  buffer, dynamic buffers off), each open TLS connection holds roughly 20–40 KB of heap. The
  socket is always open, and a power or roster request briefly adds a second connection.
• The orchestrator has to serve it. On a LAN host that means a reverse proxy or its own
  certificate, and the device then needs that certificate's CA, or a pin, in flash or NVS.
• Cleartext is the status quo on both transports. WiThrottle has no authentication at all:
  anyone on the layout WiFi can drive through JMRI. That puts the real boundary at the WiFi
  password. Under that model, the orchestrator cookie's 30-day sliding lifetime is the part
  that widens the exposure.

Acceptance Criteria

• The facts above are recorded, and CLAUDE.md's Open limits names the question.
• Decision (owner): accept cleartext on the layout WiFi as the boundary, as F-18
  did for NVS; or shorten the operator session lifetime orchestrator-side; or add TLS
  on both ends. Record the outcome in CLAUDE.md's transport section.