Jakub Zych 8e4b863a3f fix: /fetch, /refresh, /update and /change-password accept the session cookies the jwt guard reads ...

The four routes (and the other signed-in routes through authenticate) read the bearer header, then the token and auth_token cookies, through classes.SessionToken and one cookie-aware guard.
A bearer header still wins and no credentials stays 401 with the old bodies.
A cookie-carried /refresh answers the rotated token in the body and writes no cookie.

2026-10-22 21:45:52 +02:00

13 KiB

Raw Blame History

View Raw