Repository navigation

fix(session): Reject non-user access tokens in session cookies - #573

Merged

gjtorikian merged 3 commits into

mainfrom

fix/session-user-access-token-claims

Nov 6, 2026

Merged

fix(session): Reject non-user access tokens in session cookies#573
gjtorikian merged 3 commits into
mainfrom
fix/session-user-access-token-claims

Commits on Nov 4, 2026
- fix(session): Reject non-user access tokens in session cookies
  
  m0tzy
  and
  devin-ai-integration[bot]
  committed
  9a4e945
- test(session): Cover invalid sid and auth_time claim types
  
  m0tzy
  and
  devin-ai-integration[bot]
  committed
  4bbc323
- test(session): Cover expired non-user token with include_expired
  
  m0tzy
  and
  devin-ai-integration[bot]
  committed
  32205a1