cosmik.network
A social knowledge tool for researchers built on ATProto
Revert "The changes look good! These modifications will help handle the Safari iOS PWA cookie issue while keeping `scope: '/'`."
This reverts commit 89d51b600b6ad4ececa052c88552ca1e227e92c6.
+5
-6
src/webapp/hooks/useAuth.tsx
+5
-6
src/webapp/hooks/useAuth.tsx
···
49
49
// Give it time for cookies to be properly set
50
50
if (query.isError && !query.isLoading && pathname !== '/') {
51
51
// Add a small delay for Safari iOS cookie handling
52
-
const isSafariIOS =
53
-
/iPad|iPhone|iPod/.test(navigator.userAgent) &&
54
-
/Safari/.test(navigator.userAgent) &&
55
-
!/Chrome/.test(navigator.userAgent);
56
-
52
+
const isSafariIOS = /iPad|iPhone|iPod/.test(navigator.userAgent) &&
53
+
/Safari/.test(navigator.userAgent) &&
54
+
!/Chrome/.test(navigator.userAgent);
55
+
57
56
if (isSafariIOS) {
58
57
setTimeout(() => {
59
58
// Re-check auth status before logging out
···
62
61
logout();
63
62
}
64
63
});
65
-
}, 2000); // Increase to 2 seconds for PWA context
64
+
}, 1000);
66
65
} else {
67
66
logout();
68
67
}
-4
src/webapp/lib/auth/dal.ts
-4
src/webapp/lib/auth/dal.ts
···
1
1
import type { GetProfileResponse } from '@/api-client/ApiClient';
2
2
import { cache } from 'react';
3
-
import { isPWA } from './pwa-cookie-handler';
4
3
5
4
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://127.0.0.1:4000';
6
5
···
21
20
const response = await fetch(`${appUrl}/api/auth/me`, {
22
21
method: 'GET',
23
22
credentials: 'include', // HttpOnly cookies sent automatically
24
-
headers: {
25
-
'X-PWA-Context': isPWA() ? 'true' : 'false',
26
-
},
27
23
});
28
24
29
25
if (!response.ok) {
+2
-38
src/webapp/services/auth/CookieAuthService.client.ts
+2
-38
src/webapp/services/auth/CookieAuthService.client.ts
···
1
-
import {
2
-
isPWA,
3
-
getCookieForPWA,
4
-
setCookieForPWA,
5
-
} from '@/lib/auth/pwa-cookie-handler';
6
-
7
1
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://127.0.0.1:4000';
8
2
9
3
export class ClientCookieAuthService {
10
-
// Note: With HttpOnly cookies, we cannot read tokens from document.cookie in regular browser
11
-
// But in PWA context, we may need to handle cookies differently
4
+
// Note: With HttpOnly cookies, we cannot read tokens from document.cookie
5
+
// The browser automatically sends cookies with requests using credentials: 'include'
12
6
// All auth logic (checking status, refreshing tokens) is handled by /api/auth/me endpoint
13
7
14
-
// Check if we have any auth indicators (for PWA context)
15
-
static hasAuthIndicators(): boolean {
16
-
if (isPWA()) {
17
-
return !!(
18
-
getCookieForPWA('accessToken') || getCookieForPWA('refreshToken')
19
-
);
20
-
}
21
-
// In regular browser, we can't check HttpOnly cookies
22
-
return true; // Let the server-side check handle it
23
-
}
24
-
25
8
// Clear cookies via API (logout)
26
9
static async clearTokens(): Promise<void> {
27
10
try {
28
11
const response = await fetch(`${appUrl}/api/auth/logout`, {
29
12
method: 'POST',
30
13
credentials: 'include',
31
-
headers: {
32
-
'X-PWA-Context': isPWA() ? 'true' : 'false',
33
-
},
34
14
});
35
15
36
16
if (!response.ok) {
···
38
18
'Logout API call failed, but continuing with client-side logout',
39
19
);
40
20
}
41
-
42
-
// In PWA context, also clear any client-side cookies
43
-
if (isPWA()) {
44
-
document.cookie =
45
-
'accessToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax';
46
-
document.cookie =
47
-
'refreshToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax';
48
-
}
49
21
} catch (error) {
50
22
console.error('Logout API call failed:', error);
51
23
// Don't throw - we still want to clear the UI state
52
-
53
-
// Still try to clear PWA cookies on error
54
-
if (isPWA()) {
55
-
document.cookie =
56
-
'accessToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax';
57
-
document.cookie =
58
-
'refreshToken=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; secure; samesite=lax';
59
-
}
60
24
}
61
25
}
62
26
}