bert.hausmans
513ca519b2
Backend: - CookieBearerToken middleware reads httpOnly cookie and injects Authorization header before Sanctum validates (prepended to API middleware group) - SetAuthCookie trait provides cookie creation/expiry helpers with per-app cookie names (crewli_admin_token, crewli_app_token, crewli_portal_token) - LoginController sets token via Set-Cookie, removes it from JSON body - LogoutController expires the auth cookie on logout - AuthRefreshController (POST /auth/refresh) rotates tokens with new cookie - InvitationController accept also sets token via cookie, not JSON body - All cookies: httpOnly, SameSite=Strict, Secure (in production) Frontend (all three SPAs): - Removed all localStorage token storage (apps/app, apps/portal) - Removed all JS-readable cookie token storage (apps/admin) - Removed Authorization: Bearer header interceptors from axios - Auth stores now rely on GET /auth/me to validate httpOnly cookie - Admin app: new Pinia auth store replaces useCookie-based auth pattern - withCredentials: true ensures browser sends cookies automatically Fixes security findings A13-1 (localStorage tokens) and A13-2 (admin cookie flags). Tokens are now invisible to JavaScript. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
56 lines
1.3 KiB
TypeScript
56 lines
1.3 KiB
TypeScript
import axios from 'axios'
|
|
import type { AxiosInstance, InternalAxiosRequestConfig } from 'axios'
|
|
|
|
const apiClient: AxiosInstance = axios.create({
|
|
baseURL: import.meta.env.VITE_API_URL,
|
|
withCredentials: true,
|
|
headers: {
|
|
Accept: 'application/json',
|
|
'Content-Type': 'application/json',
|
|
},
|
|
timeout: 30000,
|
|
})
|
|
|
|
apiClient.interceptors.request.use(
|
|
(config: InternalAxiosRequestConfig) => {
|
|
if (import.meta.env.DEV) {
|
|
console.log(`🚀 ${config.method?.toUpperCase()} ${config.url}`, config.data)
|
|
}
|
|
|
|
return config
|
|
},
|
|
error => Promise.reject(error),
|
|
)
|
|
|
|
apiClient.interceptors.response.use(
|
|
response => {
|
|
if (import.meta.env.DEV) {
|
|
console.log(`✅ ${response.status} ${response.config.url}`, response.data)
|
|
}
|
|
|
|
return response
|
|
},
|
|
error => {
|
|
if (import.meta.env.DEV) {
|
|
console.error(
|
|
`❌ ${error.response?.status} ${error.config?.url}`,
|
|
error.response?.data,
|
|
)
|
|
}
|
|
|
|
if (error.response?.status === 401) {
|
|
// Lazy import to avoid circular dependency
|
|
import('@/stores/useAuthStore').then(({ useAuthStore }) => {
|
|
const authStore = useAuthStore()
|
|
if (authStore.isInitialized) {
|
|
authStore.handleUnauthorized()
|
|
}
|
|
})
|
|
}
|
|
|
|
return Promise.reject(error)
|
|
},
|
|
)
|
|
|
|
export { apiClient }
|