Reads and verifies the session cookie from a request, then rejects it unless
it was minted as a cookie session and its embedded credential fingerprint
still matches the live credentials — so a password rotation or allow-list
change evicts every session issued before it, and an API access token cannot
be pasted into the cookie to impersonate one.
Reads and verifies the session cookie from a request, then rejects it unless it was minted as a cookie session and its embedded credential fingerprint still matches the live credentials — so a password rotation or allow-list change evicts every session issued before it, and an API access token cannot be pasted into the cookie to impersonate one.