KamoCRM

Resolve system-user session from OTK for BFF requests

FixSecurityService
Ya
23 Aprili 2026, 23:29 UTC
Mwandishi
Kamo
Ahadi ya
1361dea

SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never saw a session and returned 403 for legitimate top-level owners. Use the same resolution as EnterAsController: prefer OTKPreAuthFilter session attribute, then *** cookie. Extract shared CallerSessionResolver.

Mabadiliko yote

Je, unaona nini kuhusu usafiri?

Kila kitu kinaingia kwenye tovuti yako mwenyewe. Anza kwenye mpango wa bure na usome ukurasa huu tena katika mwezi mmoja.

Kuwa Huru MileleMtazamo wa bei