From f466ce3e9f023cfe4dcefa29ab490958c352071f Mon Sep 17 00:00:00 2001 From: Daniel Date: Tue, 14 Apr 2026 04:55:12 +0200 Subject: [PATCH] Fix critical auth bug: set httpOnly cookie on local login/register MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After the hybrid auth migration, web users log in but the setAuthCookie() helper was never actually called in /login or /register — only in the OIDC callback. Result: local sign-in worked until the first page reload, then the user appeared logged out. The Settings page's Active Sessions list came up empty because /api/sessions received no auth. Added setAuthCookie(res, token) calls on successful: - /register (auto-verified first admin path) - /login (after TOTP / backup code verification) Mobile is unaffected — it uses Bearer from Keychain and always has. --- src/routes/auth.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/routes/auth.js b/src/routes/auth.js index 1243911..921bd2d 100644 --- a/src/routes/auth.js +++ b/src/routes/auth.js @@ -240,6 +240,7 @@ router.post('/register', async (req, res) => { await db.run('INSERT INTO user_sessions (id, user_id, token_hash, ip_address, user_agent, device_label) VALUES (?, ?, ?, ?, ?, ?)', [regSessionId, userId, hashToken(token), req.ip, req.headers['user-agent'] || '', parseUserAgent(req.headers['user-agent'])]); } catch (e) { /* table may not exist yet */ } + setAuthCookie(res, token); return res.json({ success: true, token: token, sessionId: regSessionId, user: { id: userId, email: email.toLowerCase(), name: name, role: role, email_verified: true }, @@ -376,6 +377,7 @@ router.post('/login', async (req, res) => { // Notify user of new login (fire-and-forget) notifyNewLogin(user.id, parseUserAgent(req.headers['user-agent']), req.ip); + setAuthCookie(res, token); res.json({ success: true, token: token, sessionId: sessionId, user: { id: user.id, email: user.email, name: user.name, role: user.role, totp_enabled: user.totp_enabled, email_verified: user.email_verified }