gitadmin/INSIGHT-MVP
1
0
Fork 0
mirror of http://172.20.10.11:3000/gitadmin/INSIGHT-MVP.git synced 2026-06-24 22:46:39 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: set refresh token (not access token) in HttpOnly cookie

Browse source 
The login endpoint was incorrectly storing the access token in the
refresh_token cookie. This caused silent refresh to fail after page
reload since the short-lived access token couldn't be used for refresh.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Thomas Reitz 2026-03-08 20:49:41 +01:00
parent 779d90ca43
commit 1643db0e7b
2 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
packages/core-service/src/core/auth/auth.controller.ts
View file

@ -45,7 +45,7 @@ export class AuthController {
// Refresh-Token als HttpOnly Cookie setzen (NICHT im localStorage!) // Refresh-Token als HttpOnly Cookie setzen (NICHT im localStorage!)
// Regel: Kein localStorage fuer Tokens // Regel: Kein localStorage fuer Tokens
this.setRefreshTokenCookie(res, result.accessToken); this.setRefreshTokenCookie(res, result.refreshToken);
return { return {
accessToken: result.accessToken, accessToken: result.accessToken,

2
packages/core-service/src/core/auth/auth.service.ts
View file

@ -21,6 +21,7 @@ interface TokenPair {
interface LoginResponse { interface LoginResponse {
accessToken: string; accessToken: string;
refreshToken: string;
user: { user: {
id: string; id: string;
email: string; email: string;
@ -151,6 +152,7 @@ export class AuthService {
return { return {
accessToken: tokens.accessToken, accessToken: tokens.accessToken,
refreshToken: tokens.refreshToken,
user: { user: {
id: user.id, id: user.id,
email: user.email, email: user.email,