ros/automaker
1
0
Fork 0
mirror of https://github.com/AutoMaker-Org/automaker.git synced 2026-01-30 06:12:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: persist session token to localStorage for web mode page reload survival

Browse Source 
Web mode sessions were being lost on page reload because the session token was
stored only in memory (cachedSessionToken). When the page reloaded, the token
was cleared and verifySession() would fail, redirecting users to login.

This commit adds localStorage persistence for the session token, ensuring:
1. Token survives page reloads in web mode
2. verifySession() can use the persisted token from localStorage
3. Token is cleared properly on logout
4. Graceful fallback if localStorage is unavailable (SSR, disabled storage)

The HTTP-only cookie alone isn't sufficient for web mode due to SameSite cookie
restrictions and potential proxy issues with credentials forwarding.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
DhanushSantosh
2026-01-18 02:02:10 +05:30
parent fdad82bf88
commit a7f7898ee4
1 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
apps/ui/src/lib/http-api-client.ts
View File

@@ -179,8 +179,24 @@ let apiKeyInitialized = false;
let apiKeyInitPromise: Promise<void> | null = null;
// Cached session token for authentication (Web mode - explicit header auth)
// Only used in-memory after fresh login; on refresh we rely on HTTP-only cookies
// Persisted to localStorage to survive page reloads
let cachedSessionToken: string | null = null;
const SESSION_TOKEN_KEY = 'automaker:sessionToken';
// Initialize cached session token from localStorage on module load
// This ensures web mode survives page reloads with valid authentication
const initSessionToken = (): void => {
if (typeof window === 'undefined') return; // Skip in SSR
try {
cachedSessionToken = window.localStorage.getItem(SESSION_TOKEN_KEY);
} catch {
// localStorage might be disabled or unavailable
cachedSessionToken = null;
}
};
// Initialize on module load
initSessionToken();
// Get API key for Electron mode (returns cached value after initialization)
// Exported for use in WebSocket connections that need auth
@@ -200,14 +216,30 @@ export const waitForApiKeyInit = (): Promise<void> => {
// Get session token for Web mode (returns cached value after login)
export const getSessionToken = (): string | null => cachedSessionToken;
// Set session token (called after login)
// Set session token (called after login) - persists to localStorage for page reload survival
export const setSessionToken = (token: string | null): void => {
cachedSessionToken = token;
if (typeof window === 'undefined') return; // Skip in SSR
try {
if (token) {
window.localStorage.setItem(SESSION_TOKEN_KEY, token);
} else {
window.localStorage.removeItem(SESSION_TOKEN_KEY);
}
} catch {
// localStorage might be disabled; continue with in-memory cache
}
};
// Clear session token (called on logout)
export const clearSessionToken = (): void => {
cachedSessionToken = null;
if (typeof window === 'undefined') return; // Skip in SSR
try {
window.localStorage.removeItem(SESSION_TOKEN_KEY);
} catch {
// localStorage might be disabled
}
};
/**