semble/src/shared/infrastructure/http/ at 678e8cd70939f6deef96e113c10f60fff499a458 · nandi.uk/semble · Tangled

nandi.uk / semble

0

This repository has no description

0

semble / src / shared / infrastructure / http

4 folders 2 files

at 678e8cd70939f6deef96e113c10f60fff499a458

Wesley Finck fix build errors and tests 9mo ago

fix build errors and tests

9 months ago

formatting and comment removal

9 months ago

ran lint fix

1 year ago

feat: implement cookie-based authentication This commit refactors the authentication system to use secure httpOnly cookies instead of passing tokens via URL parameters and relying solely on localStorage. ## Backend Changes ### New Services - Created `CookieService` for centralized cookie management - Automatically determines cookie domain based on environment (local/dev/prod) - Sets appropriate security flags (httpOnly, secure, sameSite) - Handles both access and refresh token cookies ### Updated Controllers - `CompleteOAuthSignInController`: Now sets tokens in cookies instead of URL redirect - `RefreshAccessTokenController`: Reads refresh token from cookies (with body fallback) - `LogoutController`: Clears authentication cookies on logout ### Middleware Updates - `AuthMiddleware`: Now supports both cookie-based and Bearer token authentication - `ensureAuthenticated()`: Accepts tokens from cookies OR Authorization header - `requireBearerAuth()`: Legacy support for Bearer token only - `requireCookieAuth()`: Enforces cookie-based auth only - `optionalAuth()`: Optional authentication with fallback ### Infrastructure - Updated CORS configuration to enable credentials and restrict origins by environment - Added `cookie-parser` middleware to Express app - Updated `ServiceFactory` and `ControllerFactory` to inject `CookieService` ## Frontend Changes ### Auth Flow - Updated `/auth/complete` page to work with cookies (no longer extracts tokens from URL) - Created `/test-page` for testing cookie authentication - Tests the `/me` endpoint with cookie-based auth - Shows profile data if authenticated - Provides logout and refresh functionality ## Security Improvements - Tokens no longer exposed in URL parameters (browser history) - httpOnly cookies prevent XSS attacks from accessing tokens - Appropriate cookie domains for cross-subdomain auth (.semble.so, .dev.semble.so) - sameSite=lax prevents CSRF while allowing OAuth flows ## Backward Compatibility - AuthMiddleware still accepts Bearer tokens for existing clients - RefreshAccessTokenController accepts refresh tokens in request body as fallback - All responses still include tokens in body for legacy support 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

9 months ago

formatted all files with new formatting convention

1 year ago

Merge pull request #66 from weswalla/cyrus/sem-9-use-cookies-for-auth feat: implement cookie-based authentication

9 months ago