fix(auth): remove X-User-Id header trust to prevent BOLA (fixes #2065) - #2068

Open

namann5 wants to merge 7 commits into

utksh1:mainfrom

namann5:fix/x-user-id-header-spoofing-bypass

Commits on Jul 23, 2026

fix(auth): remove X-User-Id header trust for owner identity to prevent BOLA
namann5
committed
5668e6b

Commits on Jul 24, 2026

test(auth): update owner-resolution and BOLA tests for X-User-Id removal
namann5
committed
16da475
fix(tests): fix saved_views auth rejection tests using no_auth_app_client
namann5
committed
dcec8ec
Merge branch 'main' into fix/x-user-id-header-spoofing-bypass
namann5
authored
0e4bab1

Commits on Jul 31, 2026

docs(auth): update owner-scoping docs to reflect X-User-Id removal
namann5
committed
68b64d3

Commits on Aug 4, 2026

Merge branch 'main' into fix/x-user-id-header-spoofing-bypass
namann5
authored
da6e603

Commits on Aug 5, 2026

Merge remote-tracking branch 'upstream/main' into fix/x-user-id-header-spoofing-bypass
namann5
committed
90eb68c