Repository navigation
Keep session admin shells isolated from stored bearer tokens - #51
Merged
Merged
Conversation
intel352
marked this pull request as ready for review
October 9, 2026 00:42
intel352
enabled auto-merge (squash)
October 9, 2026 00:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A host using AuthModeSession can have a stale bearer token left in local storage. The shared shell still forwards that token to API calls and embedded tools, allowing it to override a valid cookie session. Session mode now ignores bearer storage and leaves it unchanged; default/unknown bearer modes retain their behavior. The host remains responsible for authentication and authorization.
Validation atb6f7428922800021665c85aad6c90c08b337c28f: independent source approval, 2 executable Node tests, bounded all-package Go race suite, and all exact-head CI/CodeQL/cross-platform checks PASS. Actual multisite TLS browser scenario reproduces stale-token shell reload failure with v1.1.18 and passes with this source, together with embedded/fullscreen/reload/mobile/keyboard/session-loss checks. No hosted credentials or live services used.
This reusable repair is in its original project; multisite draft#129 will pin the real release before merge/deploy. Authorization inspector standalone repair is GoCodeAlone/workflow-plugin-authz-ui#29. Repository branch protection requires one GitHub approving review; standard existing auto-merge is queued and waits for that approval. No administrative bypass, new authorization access, branch-protection change or live deployment.