AIKIDO-2026-891012

TL;DR

Oidcc.Plug.Authorize records the request user agent for later session binding but reads the header with the mixed-case key User-Agent, which never matches Plug's downcased header names, so nil is stored in the session instead of the real value. On callback, Oidcc.Plug.AuthorizationCallback treats the stored nil as nothing to compare and returns success, so the user agent binding never fires even when check_useragent is enabled. The fix reads the header with the lowercase user-agent key so the stored value and comparison work.