- Ya
- 29 Aprili 2026, 22:20 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 6b4a436
auto-login accepted any *** and minted an OTK pointing back at it, regardless of which org the destination internal.* host belongs to. A stale or cross-org *** cookie surfaced at login.<host> would have been propagated into that host's internal subdomain, producing the "my session is for the wrong org" symptom. Resolve the current host's apex domain to its org via /api/security/org/domain and require the session's orgID to match before issuing the OTK. Fail-open on resolver errors to preserve current behavior when SecurityService is unreachable.