sandrodachandClaude Opus 5.5 f57a9884d1 fix(security): stream tickets instead of session tokens in URLs (FLAW-22) ...

WebSocket and EventSource put the 30-day session token into the URL,
where proxies log it. The app now gets a one-time ticket right before
connecting (POST /auth/stream-ticket, 60 s, bound to the token version);
?token= is no longer accepted for streams, non-browser clients may use
the Authorization header.

With BASE_URL set, CORS allows only that origin and WebSocket upgrades
only it or the requested host; credentials are off (no cookies exist).
Logout, ending all sessions, a new password and deactivation close all
live streams of the account; clients with a valid session reconnect
with a fresh ticket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 14:46:58 +01:00

..

public

feat(pwa): start and keep working offline

2026-10-29 08:11:47 +01:00

src

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00

index.html

feat(pwa): blue splash screen with the logo, status bar follows the theme

2026-10-29 07:13:29 +01:00

package-lock.json

release: v0.4.1 – Polarized and Suri themes, due times, notes trash, backlinks, password reset, offline PWA

2026-10-29 09:07:16 +01:00

package.json

release: v0.4.1 – Polarized and Suri themes, due times, notes trash, backlinks, password reset, offline PWA

2026-10-29 09:07:16 +01:00

postcss.config.js

First draft

2026-10-24 16:56:44 +02:00

tailwind.config.js

fix(ui): opacity modifiers for theme colours (bg-accent/15 etc. were never generated)

2026-10-28 23:56:13 +01:00

tsconfig.json

First draft

2026-10-24 16:56:44 +02:00

vite.config.ts

release: v0.2 – collaboration docs, richer demo data, new screenshots

2026-10-28 15:32:31 +01:00

vitest.config.ts

test(frontend): set up Vitest with jsdom and run tests in the image build

2026-10-28 09:25:10 +01:00