Paul Lorenz 1ae9b5b121 Validate the API session token when creating circuits via CreateCircuitV3 ...

- requires an API session token on CreateCircuitV3 requests and validates it,
  covering signature, audience, token type, and revocation by token id,
  identity, and api session
- takes the dialing identity from the validated token claims rather than the
  router-supplied identity id, and rejects a request whose asserted identity
  does not match the token subject
- adds the api session id to the log context, matching the V1 and V2 paths
- adds tests for a missing token, an invalid token, and a token belonging to a
  different identity than the one asserted
- notes the advisory in the 2.0.3 release notes

2026-08-20 15:38:27 -04:00

..

messages.go

Validate the API session token when creating circuits via CreateCircuitV3

2026-08-20 15:38:27 -04:00