ENG-7204: Re-Implement Basic Auth / User Switching Logout Fix Correctly — Ship 1.0.5 - #9

Merged

loukie-pressable merged 11 commits into

mainfrom

johnluke/eng-7204-re-implement-basic-auth-user-switching-logout-fix-correctly

Sep 15, 2026

Commits on Sep 15, 2026

ENG-7204: Re-apply the User Switching logout fix as 1.0.5
loukieluke
committed
c823c83
ENG-7204: Match excluded endpoints on the request path, not the raw URI
loukieluke
committed
5c6e1f4
ENG-7204: Pin CI to the supported PHP range, and record what the init hook costs
loukieluke
committed
66dd9b0
ENG-7204: Refuse to waive auth for a path carrying a traversal segment
loukieluke
committed
d930787
ENG-7204: Gate the release on the same PHP range as pull requests
loukieluke
committed
67adb00
ENG-7204: Match what the server executes, not what the caller requested
loukieluke
committed
85f92db
ENG-7204: Only refuse a REST endpoint when a script PRECEDES it
loukieluke
committed
4bd4fe4
ENG-7204: Keep the first path segment on a target beginning with two slashes
loukieluke
committed
cded14e
ENG-7204: Bump the release workflow checkout to v4, don't persist its token
loukieluke
committed
6a9978f
ENG-7204: Don't treat the X-Requested-With header as AJAX (auth bypass)
loukieluke
committed
d29a41e
ENG-7204: Note the X-Requested-With bypass fix in the changelog
loukieluke
committed
97fd440