Make auth work from a Capacitor WebView origin (JWT-only, CORS/CSRF for capacitor://localhost) #22

New Issue

2026-07-26T04:54:15-07:00

westfarn commented

2026-07-26 04:54:15 -07:00

Risk

Blocks #20 (Android) and #21 (iOS).

Today llm-fe/src/axiosApi.js authenticates with a JWT plus a CSRF cookie read via js-cookie. In a browser the app and API are same-site-ish (chat.aimloperations.com -> chatbackend.aimloperations.com), so the cookie flow works. Inside Capacitor the page origin is https://localhost (Android) or capacitor://localhost (iOS), which is cross-site relative to the backend domain, and WKWebView blocks third-party cookies by default. Result: the CSRF cookie is never readable, POSTs get rejected, and login fails on device even though the same bundle works in a browser.

Work

Audit src/axiosApi.js and the auth context for every request that depends on a cookie (CSRF token, session, refresh token).
Move the native path to header-only auth: Authorization bearer JWT, refresh token in Capacitor Preferences / secure storage rather than a cookie.
Confirm whether Django CSRF enforcement can be skipped for JWT-authenticated API endpoints, or supply the CSRF token via a header fetched from an endpoint instead of a cookie.
chat_backend changes: add https://localhost and capacitor://localhost to CORS_ALLOWED_ORIGINS and CSRF_TRUSTED_ORIGINS; verify preflight (OPTIONS) responses and Access-Control-Allow-Credentials behavior.
Decide on a single strategy that works for web + Android + iOS so we do not fork the auth code per platform.
Verify on device: login, token refresh after expiry, logout, password reset, 401 handling.

Done when

Login, refresh, and an authenticated API call all succeed from a Capacitor build on both platforms, with no cookie dependency, and the browser build still works unchanged.

## Risk Blocks #20 (Android) and #21 (iOS). Today `llm-fe/src/axiosApi.js` authenticates with a JWT plus a CSRF cookie read via `js-cookie`. In a browser the app and API are same-site-ish (`chat.aimloperations.com` -> `chatbackend.aimloperations.com`), so the cookie flow works. Inside Capacitor the page origin is `https://localhost` (Android) or `capacitor://localhost` (iOS), which is cross-site relative to the backend domain, and WKWebView blocks third-party cookies by default. Result: the CSRF cookie is never readable, POSTs get rejected, and login fails on device even though the same bundle works in a browser. ## Work - [ ] Audit `src/axiosApi.js` and the auth context for every request that depends on a cookie (CSRF token, session, refresh token). - [ ] Move the native path to header-only auth: `Authorization` bearer JWT, refresh token in Capacitor Preferences / secure storage rather than a cookie. - [ ] Confirm whether Django CSRF enforcement can be skipped for JWT-authenticated API endpoints, or supply the CSRF token via a header fetched from an endpoint instead of a cookie. - [ ] `chat_backend` changes: add `https://localhost` and `capacitor://localhost` to `CORS_ALLOWED_ORIGINS` and `CSRF_TRUSTED_ORIGINS`; verify preflight (`OPTIONS`) responses and `Access-Control-Allow-Credentials` behavior. - [ ] Decide on a single strategy that works for web + Android + iOS so we do not fork the auth code per platform. - [ ] Verify on device: login, token refresh after expiry, logout, password reset, 401 handling. ## Done when Login, refresh, and an authenticated API call all succeed from a Capacitor build on both platforms, with no cookie dependency, and the browser build still works unchanged.

westfarn referenced this issue

2026-07-26 04:54:29 -07:00

Harden chat WebSocket for mobile lifecycle (background/resume, network switch, reconnect) #23

westfarn added a new dependency 2026-07-26 04:55:27 -07:00

#20 Ship Android app by wrapping the web build with Capacitor

westfarn added a new dependency 2026-07-26 04:55:28 -07:00

#21 Ship iOS app by wrapping the web build with Capacitor

westfarn referenced this issue

2026-07-26 04:55:56 -07:00

Ship Android app by wrapping the web build with Capacitor #20

westfarn referenced this issue

2026-07-26 04:56:01 -07:00