add0b17e04
Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
17 lines
510 B
TypeScript
17 lines
510 B
TypeScript
export async function getAuthUrl(url: string, purpose: 'download' | 'immich'): Promise<string> {
|
|
if (!url) return url
|
|
try {
|
|
const resp = await fetch('/api/auth/resource-token', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
credentials: 'include',
|
|
body: JSON.stringify({ purpose }),
|
|
})
|
|
if (!resp.ok) return url
|
|
const { token } = await resp.json()
|
|
return `${url}${url.includes('?') ? '&' : '?'}token=${token}`
|
|
} catch {
|
|
return url
|
|
}
|
|
}
|