The request headers Drupal sees besides the ones the serve path already carries by name.
A headless site reads Authorization, X-Api-Key, Origin and User-Agent off the request, and
the serve path used to hand Drupal only the cookie, the accept header, the content type and the
client address, so every bearer-token route answered as if no token had been sent.
The request headers Drupal sees besides the ones the serve path already carries by name.
A headless site reads
Authorization,X-Api-Key,OriginandUser-Agentoff the request, and the serve path used to hand Drupal only the cookie, the accept header, the content type and the client address, so every bearer-token route answered as if no token had been sent.