Request-target from getStartingLine().path includes the query string (e.g. "/set-password?token=abc"), causing exact-match public-path checks like `path == "/set-password"` in IAuthPolicy::isPublicPath to fail and the request to be rejected with 401. Strip the query string once at the top of intercept() so policies and access logs see clean paths. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| auth | ||
| db | ||
| handler | ||
| interceptor | ||
| startup | ||
| systemd | ||
| util | ||
| ws | ||