{"version":"2.1.238","anchor":"requests-no-longer-send-cookie-and-bearer-credentials-togeth","canonical_anchor":"requests-no-longer-send-cookie-and-bearer-credentials-togeth","heading":"Requests no longer send cookie and bearer credentials together","tier":"notice","area":"Internals","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/requests-no-longer-send-cookie-and-bearer-credentials-togeth","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Requests no longer send cookie and bearer credentials together\n\nRequests now send only one form of credential, never a cookie and a bearer token together.\n\n**What**\n\nOutgoing request headers are now cleaned so only one credential goes out: a cookie removes the `Authorization` header, and an `Authorization` header removes both the cookie and `X-Organization-Uuid`.\n\n**Details**\n\n- The bearer header is now built by a shared constructor rather than each site writing `Bearer` itself.\n\n**Evidence**\n\n`X-Organization-Uuid`\n\n- Area: Internals\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}