Incident Dossier

Redirect drops authorization

After the auth service moved from `/v1` to `/v2`, every client started receiving 401 Unauthorized on what should have been the canonical `/me` endpoint. The bearer token was attached to the original request but never reached the redirected URL. Logs show the v2 request was made with no Authorization header at all.

Initial failing signalv2/me returns 401 after a 302 redirectExpected behavior: status 200 after a 302 redirect when Authorization was set on the original request · actual behavior: status 401 because the redirected request had no Authorization header

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the failing assertion: a 302 redirect dropped the bearer token.
Trace how the redirect-follower builds the next-hop request.
Forward the original request headers on every hop.

Focus Mode

Start

src/redirect.js

Likely area

src/redirect.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicNetwork & Connectivity

DifficultyEasy

Est. time12 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace