mirror of
https://github.com/movixcorp/MovixOpenSource.git
synced 2026-07-27 13:22:14 +00:00
487a6e1481
- Stop storing discord_token and google_token in localStorage (XSS risk) These tokens are never read, only written; backend already stores them server-side in user data files. - Remove discord_token and google_token from AUTH_KEYS array - Add cookie-parser middleware to Express app - Add setAuthCookie() helper to set JWT as HttpOnly; Secure; SameSite=Lax cookie - Update auth routes (BIP39 register/login, Discord, Google) to set cookie - Update getAuthIfValid() to read JWT from cookie first, then Authorization header - Add extractJwtFromRequest() helper for dual-mode auth (cookie + header) - Add GET /api/auth/session endpoint to rehydrate JWT from cookie on page reload |
||
|---|---|---|
| .. | ||
| auth.js | ||
| cors.js | ||
| security.js | ||