multica

mirror of https://github.com/multica-ai/multica.git synced 2026-07-06 14:00:09 +02:00

Files

yushen 21c5516f2b feat(auth): migrate auth token to HttpOnly cookie & implement WebSocket Origin whitelist

Security improvements from the MUL-566 audit report:

1. Auth token is now set as an HttpOnly, SameSite=Lax cookie on login,
   preventing XSS-based token theft. Cookie-based auth includes CSRF
   protection via double-submit cookie pattern. The Authorization header
   path is preserved for Electron desktop app and CLI/PAT clients.

2. WebSocket upgrader now validates the Origin header against a
   configurable allowlist (ALLOWED_ORIGINS env var), rejecting
   connections from unauthorized origins.

Backend: new auth cookie helpers, middleware reads cookie as fallback,
WS handler accepts cookie auth, Origin whitelist, logout endpoint.
Frontend: CSRF token in API headers, cookie-aware auth store and WS
client, web app opts into cookieAuth mode while desktop keeps tokens.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 11:36:00 +08:00

cmd

feat(auth): migrate auth token to HttpOnly cookie & implement WebSocket Origin whitelist

2026-04-13 11:36:00 +08:00

internal

feat(auth): migrate auth token to HttpOnly cookie & implement WebSocket Origin whitelist

2026-04-13 11:36:00 +08:00

migrations

feat(search): add project search support to Cmd+K search (#663 )

2026-04-10 20:59:32 +08:00

pkg

fix(agent): enable network access for Codex sandbox so Multica CLI can reach API