Paul Lorenz f1264086d4 Restore legacy API session activity marking for REST requests. Fixes #4365 ...

- resolves zt-session tokens eagerly when the request context is created, so every request carrying one marks activity and gets session lifetime headers, regardless of endpoint
- marks last activity in SecurityCtx.resolveZtSession once the session is loaded
- adds SecurityTokenCtx.HasZtSessionHeader, a header-only check that does not parse bearer tokens
- emits only session lifetime headers from the API wrappers and drops the unused session-error header branch, so a stale token on an anonymous endpoint stays silent as it did on 1.6.x
- tests that requests to authenticated and anonymous endpoints with a zt-session mark activity, carry lifetime headers, and are reflected by current-api-session

2026-09-09 17:20:50 -04:00

..

api.go

Optimize imports

2026-01-28 15:01:35 -05:00

body_limit.go

fixes GHSA-q8g9-jc4c-jp6q limit pre-auth request body buffering

2026-07-23 17:04:43 -04:00

context.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

cors.go

Restore legacy API session activity marking for REST requests. Fixes #4365

2026-09-09 17:20:50 -04:00

json_fields.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

responder.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

timeouts.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00