70f6c6befb
get_current_user and get_current_user_optional now reject any token whose payload carries type="refresh". Access tokens carry no type field so the check is asymmetric and safe. Prevents a refresh-cookie value from being replayed as a Bearer access token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __pycache__ | ||
| authz.py | ||
| config.py | ||
| database.py | ||
| dependencies.py | ||
| logging.py | ||
| redis.py | ||
| secrets_config.py | ||
| security.py | ||
| seed.py | ||