Skip to content

The HttpOnly cl_session cookie system (session.ts/sessionCookies.ts) is fully built but never wired into the real login flow #1684

Description

@1nonlypiece

src/lib/backend/session.ts defines SESSION_COOKIE_NAME = 'cl_session' and src/lib/backend/sessionCookies.ts's applySessionCookie() sets it as an HttpOnly cookie with CSRF-token rotation (rotateCsrfToken) — a complete, more secure session design. However, applySessionCookie (and everything else exported from sessionCookies.ts) is referenced nowhere outside its own definition file: a repo-wide search finds no route ever imports or calls it. The actual login endpoint, POST /api/auth/verify (src/app/api/auth/verify/route.ts), never sets any cookie at all — it only returns sessionToken in the JSON response body, and the client (src/hooks/useWallet.ts) is left to manually persist it, including setting a plain, non-HttpOnly document.cookie = "session=..." (already flagged elsewhere for the XSS/token-theft risk that creates). Separately, src/lib/backend/requireAuth.ts's requireAuth() reads a cookie literally named 'session' — matching that insecure client-set cookie, not cl_session — so it happens to "work" with the insecure path while the properly-designed HttpOnly cl_session system sits completely dead. Acceptance criteria: wire /api/auth/verify to call applySessionCookie and issue the HttpOnly cl_session cookie as the actual session mechanism, update requireAuth/GET /api/auth/csrf to read from it, and stop useWallet.ts from setting its own insecure session cookie — or, if session.ts/sessionCookies.ts was superseded by the auth.ts design, delete the dead HttpOnly-cookie code so it doesn't mislead contributors into thinking sessions are HttpOnly-protected today.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions