bvandeusen 1e5c8b5ab7 fix(api): trim whitespace from bearer token in logout ...

sessionTokenFromHTTP now matches extractBearerToken's trimming
behavior. Without this, a bearer header with trailing whitespace
(e.g. a buggy client or proxy) authenticates via RequireUser but
hashes the padded value on logout, silently no-oping and leaving
the server-side session alive.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-20 22:32:12 -04:00

..

api.go

feat(api): GET /api/me

2026-04-20 22:11:02 -04:00

auth_test.go

fix(api): trim whitespace from bearer token in logout

2026-04-20 22:32:12 -04:00

auth.go

fix(api): trim whitespace from bearer token in logout

2026-04-20 22:32:12 -04:00

errors_test.go

feat(api): package skeleton + error envelope

2026-04-20 20:57:09 -04:00

errors.go

feat(api): package skeleton + error envelope

2026-04-20 20:57:09 -04:00

me_test.go

feat(api): GET /api/me

2026-04-20 22:11:02 -04:00

me.go

feat(api): GET /api/me

2026-04-20 22:11:02 -04:00

types.go

feat(api): POST /api/auth/login

2026-04-20 21:25:52 -04:00