also looking at this
Close unauthenticated /api/requests CRUD, and make the session cookie HttpOnly
#77
11 files
+552
-57
| @@ -44,7 +44,7 @@ | ||
| 44 | 44 | await adminStore.signOut() |
| 45 | 45 | } |
| 46 | 46 | |
| 47 | // Hydration check: if we have a token (auth.token) but no admin | |
| 47 | // Hydration check: if we have a session but no admin | |
| 48 | 48 | // profile in memory yet, refresh it. If the user is not actually an |
| 49 | 49 | // admin, bounce to /admin/login. Runs on top-level mount AND |
| 50 | 50 | // onMount so both hard-reload and SPA nav are covered (see memory |
| @@ -55,8 +55,11 @@ | ||
| 55 | 55 | if (bootstrapped) return |
| 56 | 56 | bootstrapped = true |
| 57 | 57 | |
| 58 | // Not authenticated at all → straight to login. | |
| 59 | if (!authStore.token()) { | |
| 58 | // Not authenticated at all → straight to login. Uses isAuthenticated() | |
| 59 | // rather than token(): the token is in-memory only now that the session | |
| 60 | // lives in an HttpOnly cookie, so on a hard reload of /admin it would be | |
| 61 | // empty and bounce a perfectly valid admin session to the login page. | |
| 62 | if (!authStore.isAuthenticated()) { | |
| 60 | 63 | if (typeof window !== 'undefined' && window.location.pathname !== '/admin/login') |
| 61 | 64 | navigate('/admin/login', true) |
| 62 | 65 | return |