add0b17e04
Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
1.3 KiB
JSON
52 lines
1.3 KiB
JSON
{
|
|
"name": "trek-server",
|
|
"version": "2.7.1",
|
|
"main": "src/index.ts",
|
|
"scripts": {
|
|
"start": "node --import tsx src/index.ts",
|
|
"dev": "tsx watch src/index.ts"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.28.0",
|
|
"archiver": "^6.0.1",
|
|
"bcryptjs": "^2.4.3",
|
|
"better-sqlite3": "^12.8.0",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.4.1",
|
|
"express": "^4.18.3",
|
|
"helmet": "^8.1.0",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"multer": "^2.1.1",
|
|
"node-cron": "^4.2.1",
|
|
"node-fetch": "^2.7.0",
|
|
"nodemailer": "^8.0.4",
|
|
"otplib": "^12.0.1",
|
|
"qrcode": "^1.5.4",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^6.0.2",
|
|
"unzipper": "^0.12.3",
|
|
"uuid": "^9.0.0",
|
|
"ws": "^8.19.0",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@types/archiver": "^7.0.0",
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/better-sqlite3": "^7.6.13",
|
|
"@types/cookie-parser": "^1.4.10",
|
|
"@types/cors": "^2.8.19",
|
|
"@types/express": "^4.17.25",
|
|
"@types/jsonwebtoken": "^9.0.10",
|
|
"@types/multer": "^2.1.0",
|
|
"@types/node": "^25.5.0",
|
|
"@types/node-cron": "^3.0.11",
|
|
"@types/nodemailer": "^7.0.11",
|
|
"@types/qrcode": "^1.5.5",
|
|
"@types/unzipper": "^0.10.11",
|
|
"@types/uuid": "^10.0.0",
|
|
"@types/ws": "^8.18.1",
|
|
"nodemon": "^3.1.0"
|
|
}
|
|
}
|