The ctx.state key under which auth-plugin's authentication middleware records the
credential of the strategy that authenticated the request ('header' | 'cookie'); unset when
nothing authenticated it. session-plugin's form CSRF reads it: only a request authenticated by a
'header' strategy is exempt, so a junk bearer header beside a session cookie stays verified.
Exported from common so the two packages agree on the value byte-for-byte instead of each
hardcoding the literal — the validatedStateKey precedent.
The
ctx.statekey under whichauth-plugin's authentication middleware records thecredentialof the strategy that authenticated the request ('header'|'cookie'); unset when nothing authenticated it.session-plugin's form CSRF reads it: only a request authenticated by a'header'strategy is exempt, so a junk bearer header beside a session cookie stays verified.Exported from
commonso the two packages agree on the value byte-for-byte instead of each hardcoding the literal — thevalidatedStateKeyprecedent.