v0.16.1

v0.16.1 is a small patch on top of today's v0.16.0 — one fix that completes the cookiePrefix work v0.16.0 shipped on the frontend side.

👀 Highlights

🍪 cookiePrefix is now honored on the backend too

v0.16.0 wired up @authup/client-web-nuxt's cookiePrefix on client-ui, so a deployment that widens NUXT_PUBLIC_COOKIE_DOMAIN to share its session cookie with a separately-hosted service can still avoid colliding with Authup's own hosted consoles, which write a same-named cookie on that domain.

What v0.16.0 didn't finish: the four backend services fall back to reading a plain access_token cookie whenever a request can't carry an Authorization header — the case that matters is a bucket/file stream download, which is a top-level browser navigation and so can never set that header. That fallback hardcoded the bare cookie name, so setting a prefix on the UI alone silently broke every stream/download request instead of protecting it.

// packages/server-http-kit/src/middlewares/authup/utils.ts
export function resolveAccessTokenCookieName(prefix?: string): string {
    return `${prefix ?? ''}access_token`;
}

server-core, server-storage, server-telemetry and server-messenger each gain their own COOKIE_PREFIX env var, wired through BaseServerConfig.cookiePrefix into their HTTP module's authorization middleware — the same value client-ui was already given, applied with the same plain concatenation on both sides (no separator inserted automatically by either).

Warning

If you have already set NUXT_PUBLIC_AUTHUP_COOKIE_PREFIX on client-ui, stream/download requests against your backend services have been silently failing to authenticate since you set it. Set the matching COOKIE_PREFIX on every backend service now.

📖 Deployment Configuration — Common Variables

⚠️ Heads-Up Before Upgrading

Change	What to do
A deployment with NUXT_PUBLIC_AUTHUP_COOKIE_PREFIX set on client-ui	Set the identical COOKIE_PREFIX on server-core, server-storage, server-telemetry and server-messenger — verbatim, no separator
Everyone else (no cookie prefix configured)	Nothing to do — COOKIE_PREFIX defaults to empty, unchanged behavior

⬆️ Upgrading

npm install @privateaim/server-http-kit@^0.16.1

📖 Frontend Reference — Session Cookies

👉 Changelog

compare changes

🩹 Fixes

• server-http-kit: honor cookiePrefix in the authup cookie fallback (#1891) (a0d37a6), closes #1890

📦 Dependencies

• The following workspace dependencies were updated
  • devDependencies
    • @privateaim/client-vue bumped from ^0.16.0 to ^0.16.1
    • @privateaim/client-vue-theme bumped from ^0.15.1 to ^0.16.0
    • @privateaim/core-kit bumped from ^0.15.1 to ^0.16.0
    • @privateaim/kit bumped from ^0.15.1 to ^0.16.0
    • @privateaim/storage-kit bumped from ^0.15.1 to ^0.16.0
    • @privateaim/telemetry-kit bumped from ^0.16.0 to ^0.16.1