You'll notice
Useful3 Signal2
Requests now send only one form of credential, never a cookie and a bearer token together.
What's wrong with this entry?
Anonymous. No account, no email.
What
Outgoing request headers are now cleaned so only one credential goes out: a cookie removes the Authorization header, and an Authorization header removes both the cookie and X-Organization-Uuid.
Details
- The bearer header is now built by a shared constructor rather than each site writing
Beareritself.
Evidence
X-Organization-Uuid
Strings lifted out of the shipped bundle, so the claim above can be checked against them.