KemalIdentity::Kemal::AuthenticationHandler::Precedence
Inherits Enum < Comparable < Value < Object
Which credential is resolved first when a request presents both.
Constants
Cookie = 0
The session cookie, then a bearer token only if no cookie was presented. The browser assumption, and the default.
Bearer = 1
The bearer token, then the session cookie only if no Authorization: Bearer arrived.
What an API-first monolith wants: under Cookie, a session cookie that has idle-expired
or been revoked masks a valid bearer token, because a cookie that was presented and
failed stops the resolution rather than falling through. Measured over HTTP in
blueprints/0025-maturity-validation-results.md (HTTP-03) — a same-origin SPA sending a
stale cookie beside a good token gets 401s.