Skip to content

v0.1.13

v0.1.13: security: tokens em cookies HttpOnly + CSRF double-submit (hono 4.13.12)
@JudahAragao JudahAragao tagged this 03 Oct 23:37 
- Login/register/logout em cookies HttpOnly + Secure + SameSite (env-configurável)
- Cookie CSRF legível (httpOnly: false) — double-submit X-CSRF-Token === cookie
- CSRF: Bearer (API-first) isento; sem Origin (não-browser) isento; cross-port via TRUSTED_ORIGINS
- Auto-refresh em 401 + GET /auth/me (sessão via cookie)
- admin: credentials: include, guard via /me, zero localStorage
- Tests excluídos do dist/npm (tsconfig exclude nos apps/api, worker, validation)
- media test usa tmpdir() portátil (era /tmp/opencode — quebrava o CI)
- Hono 4.0.0 → 4.13.12
- E2E API 33/33 + Admin Playwright 16/16 + gates 486 testes
Assets 2
Loading