lobo 5d608b72e6 feat(security): accept the auth cookie and guard against CSRF ...

Core reads the login token from the tbp_access cookie or a Bearer
header, whichever verifies, and parses it once per request. Unsafe
requests need an X-TBP-Client or Authorization header, CORS allows
only the exact frontend origin, and a missing or expired token
answers 401 instead of 403.

2026-09-25 13:45:08 +02:00

..

java/core_service

feat(security): accept the auth cookie and guard against CSRF

2026-09-25 13:45:08 +02:00