Files
windmill/backend/windmill-api-auth
Ruben FiszelandClaude Opus 4.8 dbae7a0ce0 fix: reject an oversized guest bearer before building the cache key
The length guard ran after the cache key was built from the token (a copy and a
hash of the whole bearer), so cap it before that work. Also correct the
strip_prefix comment: it prevents a repeated-prefix bearer from reducing to a
valid token cached under a non-canonical key, not the oversized case the length
guard handles.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3
2026-09-04 16:46:37 +02:00
..