Spaces:
Sleeping
Sleeping
Commit History
-
fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)
HonzysClawdbot +1: NykUnverified signature* fix(session-cookie): migrate to __Host- prefix for secure contexts - Update session-cookie.ts to use __Host-mc-session for HTTPS requests - Add LEGACY_MC_SESSION_COOKIE_NAME for backward compatibility with HTTP - Add parseMcSessionCookieHeader() to parse both cookie names - Add isRequestSecure() helper to detect HTTPS requests - Update cookie options to enforce Secure, HttpOnly, SameSite=Strict - Update all call sites (login, logout, google, me, proxy, auth) - Update e2e tests to support both cookie names - Update documentation (README.md, SKILL.md, openapi.json) This addresses the high-priority TODO about migrating to the __Host- prefix for enhanced security. The __Host- prefix enforces Secure + Path=/ and prevents subdomain attacks. Legacy mc-session is still supported for HTTP contexts. * fix(tests): keep login-flow cookie name aligned with response - remove unreachable nullish expression in session cookie secure flag - use returned cookie pair in login-flow spec instead of f…c9c4e2a
-
feat: initial open-source release
NykOpenClaw Mission Control — agent orchestration dashboard. Built with Next.js 16, React 19, TypeScript, SQLite, and Tailwind CSS. MIT License.bbbc03f