olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Logout now requires Authorization: Bearer <access-token>.

Browse Source
This commit is contained in:
olaf
2026-08-26 20:46:48 +02:00
parent 16c9c3a03f
commit b4b40e5c2c
9 changed files with 40 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VIBE/CHAT_LOG.md
+6
View File
@@ -1,5 +1,11 @@
# Chat Log
### User
Remedy SA-001: Logout uses non-standard token transport.
### Assistant outcome
Migrated logout to require `Authorization: Bearer <access-token>`, updated the web frontend and Firefox extension, and added regression coverage proving body-only logout is rejected while header logout revokes the access token and refresh-token family. Updated SA-001, the checklist, and README examples.
### User
Perform a new security audit overwriting Security-audit.md with new and remaining issues.
VIBE/PROMPTS.md
+1
View File
@@ -200,6 +200,7 @@
194. Replace LINKLOG_TOKEN_EXPIRY_DAYS with LINKLOG_TOKEN_EXPIRY_MINUTES, add LINKLOG_REFRESH_TOKEN_EXPIRY_DAYS to production Compose, and add a CI configuration consistency test.
195. Perform a new security audit overwriting Security-audit.md with new and remaining issues.
195. Update SA-012 and README for the implemented refresh-token lifecycle, revocation behavior, and refresh endpoint.
196. Remedy SA-001: migrate logout from JSON token transport to the Authorization bearer header.
## Future entries