ai_ml_operations/chat_web_app
2
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases Wiki Activity

Make auth JWT-only for Capacitor WebView origins (#22) #26

Merged
westfarn merged 1 commits from capacitor-jwt-auth-22 into master 2026-07-26 14:09:19 -07:00
Conversation 0 Commits 1 Files Changed 16
+503 -111
westfarn commented 2026-07-26 13:40:59 -07:00
Owner
Copy Link
Copy Source

Summary

  • Closes Make auth work from a Capacitor WebView origin (JWT-only, CORS/CSRF for capacitor://localhost) (#22)
  • Drop CSRF cookie / js-cookie path; axios uses JWT Authorization only (withCredentials: false)
  • Unified token storage: localStorage sync source of truth + optional Capacitor Preferences mirror/hydrate for native shells
  • Request interceptor always attaches fresh bearer token; 401 refresh + sign-in redirect use hash-safe native paths
  • Companion backend PR: ai_ml_operations/chat_backend branch capacitor-cors-csrf-22 (CORS/CSRF Capacitor origins)

Test plan

  • Unit tests: tokenStorage, nativePlatform, jwtHelpers, Auth/SignIn/WebSocket (npm run test:ci)
  • Login from Capacitor Android (https://localhost) and iOS (capacitor://localhost)
  • Token refresh after access expiry; logout blacklist; password reset; 401 → sign-in
  • Confirm browser build at chat.aimloperations.com unchanged
  • Merge companion backend PR so prod CORS includes Capacitor origins when CORS_ORIGIN_ALLOW_ALL=false
## Summary - Closes #22 - Drop CSRF cookie / `js-cookie` path; axios uses JWT `Authorization` only (`withCredentials: false`) - Unified token storage: `localStorage` sync source of truth + optional Capacitor Preferences mirror/hydrate for native shells - Request interceptor always attaches fresh bearer token; 401 refresh + sign-in redirect use hash-safe native paths - Companion backend PR: `ai_ml_operations/chat_backend` branch `capacitor-cors-csrf-22` (CORS/CSRF Capacitor origins) ## Test plan - [x] Unit tests: `tokenStorage`, `nativePlatform`, `jwtHelpers`, Auth/SignIn/WebSocket (`npm run test:ci`) - [ ] Login from Capacitor Android (`https://localhost`) and iOS (`capacitor://localhost`) - [ ] Token refresh after access expiry; logout blacklist; password reset; 401 → sign-in - [ ] Confirm browser build at `chat.aimloperations.com` unchanged - [ ] Merge companion backend PR so prod CORS includes Capacitor origins when `CORS_ORIGIN_ALLOW_ALL=false`
westfarn added 1 commit 2026-07-26 14:06:45 -07:00
Make auth JWT-only for Capacitor WebView origins (#22)
Unit Tests / test (pull_request) Successful in 11s
Details
8ac0b2a4ff 
Drop CSRF cookie dependency (js-cookie), store tokens via localStorage with
optional Capacitor Preferences mirror, and attach Authorization on every
request so Android/iOS shells work without third-party cookies.
westfarn force-pushed capacitor-jwt-auth-22 from a57173e25e to 8ac0b2a4ff 2026-07-26 14:06:45 -07:00 Compare
westfarn merged commit 3162ed1f7f into master 2026-07-26 14:09:19 -07:00
westfarn deleted branch capacitor-jwt-auth-22 2026-07-26 14:09:19 -07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/chat_web_app#26