Group of 2 You'll notice
Frame tunnel HTTP requests now must carry a session JWT instead of using no authentication at all
What
The internal frame-tunnel request helper previously allowed requests to the 'frame' host with no authentication at all. It now requires 'session-jwt' authentication: requests must carry a session JWT (a signed token tied to the current session). Other headers are stripped from frame-tunnel requests, and only the Authorization header captured for the session-jwt case is re-applied.
Why This closes a gap where frame-tunnel requests could be made without any authentication, ensuring they're now tied to an authenticated session.