Under the hood
Useful2 Signal3
Session registration now rejects stale or mismatched short-lived tokens instead of reusing them blindly.
What's wrong with this entry?
Anonymous. No account, no email.
What
The bridge that registers a session with the worker service now validates the short-lived token it uses, rejecting one issued for a different session, declining to register a token no fresher than the one already held, and continuing to reuse a held token past a caller-supplied age threshold when the host has nothing newer to offer.
Details
- Applies to bridge sessions that register via this token; registration goes to the worker register endpoint.
- Rejections are logged as "work secret rejected".
Evidence
work secret rejected
Strings lifted out of the shipped bundle, so the claim above can be checked against them.