- Successful SSO /auth/api/validate responses are cached per credential
and perm/renew URL for 10s, so watch websocket re-checks do not hammer
the auth backend. A POST to the logout endpoint purges all cached
entries for the request's credentials immediately, so logout/login
flows are not served stale successes.
- The watch websocket now re-validates auth before each forwarded
message and every 10s when idle (SSO and built-in sessions alike).
When the session is gone the client gets an auth error message and
the socket is closed, instead of streaming updates forever.
- Token-authenticated (API/share token) sockets are exempt from
re-validation; they are checked once at handshake.
LeoVasanko
7a0e473fb4