- Ya
- 26 Agosti 2026, 05:10 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 565c435
meet.<platform> is shared by every organization without a host of its own, and localStorage is per ORIGIN. The signed-in member's name, email and avatar were written there, so two tabs in two organizations overwrote each other: whichever loaded last decided the identity BOTH tabs displayed, and a member sat in their own meeting showing somebody else's name. None of it needed to be there. The token this page redirects with already carries context.user.name, .email and .avatar, and Meet prefers the JWT over stored settings — so the copy was redundant as well as leaky. What KamoMeet keeps for itself moved to sessionStorage, which is per tab, and anything a previous tenant left in the shared store is cleared. /api/meet/org-settings asked the HOST which organization it was serving, which answers "the platform" on the shared one — so every tenant was handed KamoCRM's meet settings, logo variant and welcome message. It now resolves the same way /api/branding and /api/config already do: the room names its organization, then ?org=, and only then the host.