- Stop storing discord_token and google_token in localStorage (XSS risk)
These tokens are never read, only written; backend already stores them
server-side in user data files.
- Remove discord_token and google_token from AUTH_KEYS array
- Add cookie-parser middleware to Express app
- Add setAuthCookie() helper to set JWT as HttpOnly; Secure; SameSite=Lax cookie
- Update auth routes (BIP39 register/login, Discord, Google) to set cookie
- Update getAuthIfValid() to read JWT from cookie first, then Authorization header
- Add extractJwtFromRequest() helper for dual-mode auth (cookie + header)
- Add GET /api/auth/session endpoint to rehydrate JWT from cookie on page reload
Modification du Oauth :
Pouvoir manager les apps depuis le panel admin
Correction de l'affichage des images des admins
Majs des urls extension, userscript et premid
Correction d'un crash sur les commentaires
Ajout d'un light mode sur le frontend
