mirror of
https://github.com/movixcorp/MovixOpenSource.git
synced 2026-07-27 05:02:08 +00:00
487a6e1481
- Stop storing discord_token and google_token in localStorage (XSS risk) These tokens are never read, only written; backend already stores them server-side in user data files. - Remove discord_token and google_token from AUTH_KEYS array - Add cookie-parser middleware to Express app - Add setAuthCookie() helper to set JWT as HttpOnly; Secure; SameSite=Lax cookie - Update auth routes (BIP39 register/login, Discord, Google) to set cookie - Update getAuthIfValid() to read JWT from cookie first, then Authorization header - Add extractJwtFromRequest() helper for dual-mode auth (cookie + header) - Add GET /api/auth/session endpoint to rehydrate JWT from cookie on page reload |
||
|---|---|---|
| .. | ||
| admin.js | ||
| adminOauthApps.js | ||
| animeSama.js | ||
| authRoutes.js | ||
| coflix.js | ||
| cpasmal.js | ||
| darkiworld.js | ||
| debrid.js | ||
| download.js | ||
| downloadLinksLeaderboard.js | ||
| dragiv.js | ||
| francetv.js | ||
| frenchstream.js | ||
| fstream.js | ||
| helpFeedback.js | ||
| oauth.js | ||
| profiles.js | ||
| proxy.js | ||
| purstream.js | ||
| search.js | ||
| sessions.js | ||
| sync.js | ||
| tmdb.js | ||
| topstream.js | ||
| vipDonations.js | ||
| vipPayblis.js | ||
| voirdrama.js | ||
| wiflix.js | ||