Logout now requires Authorization: Bearer <access-token>.

2026-08-26 20:46:48 +02:00
parent 16c9c3a03f
commit b4b40e5c2c
9 changed files with 40 additions and 14 deletions
@@ -1,5 +1,11 @@
 # Chat Log

+### User
+Remedy SA-001: Logout uses non-standard token transport.
+
+### Assistant outcome
+Migrated logout to require `Authorization: Bearer <access-token>`, updated the web frontend and Firefox extension, and added regression coverage proving body-only logout is rejected while header logout revokes the access token and refresh-token family. Updated SA-001, the checklist, and README examples.
+
 ### User
 Perform a new security audit overwriting Security-audit.md with new and remaining issues.