Authentication

Bearer token

Every authenticated endpoint expects a Firebase ID token in the Authorization header.

GET /me HTTP/1.1
Authorization: Bearer <firebase-id-token>

A missing or malformed credential returns:

{ "error": "missing bearer token" }

Why a query parameter on the WebSocket

The voice interview socket takes its token as a query parameter rather than a header:

GET /interrogation/:trialSessionId/socket?token=<firebase-id-token>

This is a browser constraint, not a design preference. The WebSocket API cannot set request headers.

Consequence for logging

Because the credential is necessarily in the URL, the server redacts req.url wholesale from its logs. A partial redaction would have to parse a URL an attacker partly controls, and getting that subtly wrong fails open.

Authorisation

Authentication establishes who you are. What you can reach is decided separately:

• Staff are scoped to the organisation their membership belongs to, with a role attached to that membership.
• Candidates reach only their own application and sessions.
• Share links for a report are a distinct, unauthenticated path guarded by an unguessable token, returning a deliberately narrower payload than the internal report.

A session the caller does not own is answered exactly as one that does not exist, so neither response reveals whose it is.