jubnl add0b17e04 feat(auth): migrate JWT storage from localStorage to httpOnly cookies ...

Eliminates XSS token theft risk by storing session JWTs in an httpOnly
cookie (trek_session) instead of localStorage, making them inaccessible
to JavaScript entirely.

- Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers
- Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange
- Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged)
- Add POST /api/auth/logout to clear the cookie server-side
- Remove all localStorage auth_token reads/writes from client
- Axios uses withCredentials; raw fetch calls use credentials: include
- WebSocket ws-token exchange uses credentials: include (no JWT param)
- authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-01 11:02:45 +02:00

..

public

Merge branch 'perf-test' of https://github.com/jubnl/TREK into dev

2026-03-31 23:10:02 +02:00

scripts

feat: add encryption key migration script and document it in README

2026-04-01 09:35:32 +02:00

src

feat(auth): migrate JWT storage from localStorage to httpOnly cookies

2026-04-01 11:02:45 +02:00

.env.example

fix: add SSRF protection for link preview and Immich URL

2026-04-01 07:59:03 +02:00

package-lock.json

feat(auth): migrate JWT storage from localStorage to httpOnly cookies

2026-04-01 11:02:45 +02:00

package.json

feat(auth): migrate JWT storage from localStorage to httpOnly cookies

2026-04-01 11:02:45 +02:00

reset-admin.js

Stabilize core: better-sqlite3, versioned migrations, graceful shutdown

2026-03-22 17:52:24 +01:00

tsconfig.json

some fixes

2026-03-30 06:59:24 +02:00