Don't invalidate *** session when it matches the new OTK session

Shipped

March 11, 2026 at 2:08 AM UTC

Author

kamo

Commit

59ffbba

The validate route was deleting the existing *** session from Redis before looking up the OTK. When the OTK pointed to the same session, the lookup would fail with "Session not found or expired". Now only invalidates the old session if its ID differs from the new one.