Resolve system-user session from OTK for BFF requests

FixSecurityService
Ya
23 Aprili 2026, 23:29 UTC
Mwandishi
Kamo
Ahadi ya
1361dea

SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never saw a session and returned 403 for legitimate top-level owners. Use the same resolution as EnterAsController: prefer OTKPreAuthFilter session attribute, then *** cookie. Extract shared CallerSessionResolver.

Mabadiliko yote

Je, unaona nini kuhusu usafiri?

Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.

Kuwa Huru MileleMtazamo wa bei