{"version":"2.1.251","anchor":"session-registration-secrets-now-checked-for-staleness","canonical_anchor":"session-registration-secrets-now-checked-for-staleness","heading":"Session registration secrets now checked for staleness","tier":"internal","area":"Cloud Sessions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/session-registration-secrets-now-checked-for-staleness","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Session registration secrets now checked for staleness\n\nSession registration now rejects stale or mismatched short-lived tokens instead of reusing them blindly.\n\n**What**\n\nThe bridge that registers a session with the worker service now validates the short-lived token it uses, rejecting one issued for a different session, declining to register a token no fresher than the one already held, and continuing to reuse a held token past a caller-supplied age threshold when the host has nothing newer to offer.\n\n**Details**\n\n- Applies to bridge sessions that register via this token; registration goes to the worker register endpoint.\n- Rejections are logged as \"work secret rejected\".\n\n**Evidence**\n\n`work secret rejected`\n\n- Area: Cloud Sessions\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}