Skip to content

Auth: consolidate cookie sessions and CSRF - #45

Merged
pedrobragabes merged 1 commit into
mainfrom
codex/issue-24-auth-cookie
Jul 16, 2026
Merged

Auth: consolidate cookie sessions and CSRF#45
pedrobragabes merged 1 commit into
mainfrom
codex/issue-24-auth-cookie

Conversation

@pedrobragabes

Copy link
Copy Markdown
Collaborator

Closes #24

Resumo

  • adota cookie HttpOnly como unico modelo de sessao e rejeita Bearer legado
  • remove localStorage como fonte de autenticacao e restaura a vitrine por /api/auth/me
  • exige JSON em login/cadastro e CSRF em todas as mutacoes por access cookie
  • estabiliza CSRF entre abas, torna logout idempotente e repete uma vez apos 403
  • corrige o header CSRF da moderacao no painel
  • define avaliacoes da v0.2 como sempre anonimas, com rate limit existente
  • recomenda cookies host-only e documenta SameSite, Secure, paths e excecao de refresh
  • cobre o inventario completo de rotas mutantes, refresh, cookies, frontend e PWA

Validacao local

  • 6 suites focadas: 27 testes passaram; inventario de rotas passou
  • npm run frontend:build e npm run frontend:check (33 arquivos)
  • npm audit --omit=dev: 0 vulnerabilidades
  • navegador: vitrine, login cookie, painel, mutacao chegando ao controller com CSRF e logout 200

Fora de escopo

A simplificacao do ciclo de refresh permanece na #27 para evitar ampliar esta issue.

@pedrobragabes
pedrobragabes marked this pull request as ready for review July 16, 2026 16:01
Copilot AI review requested due to automatic review settings July 16, 2026 16:01
@pedrobragabes
pedrobragabes merged commit 8003b09 into main Jul 16, 2026
1 check passed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@pedrobragabes
pedrobragabes deleted the codex/issue-24-auth-cookie branch July 16, 2026 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Auth: consolidar cookies, CSRF e remover Bearer legado da resposta

2 participants