v1.4.4

This release hardens first-party refresh cookies and export-key recovery mechanisms to strengthen session security and user experience.

✨ Features

🔐 Session Security

• Implemented HttpOnly refresh token cookies with automatic session auto-renewal on 401/403 responses
• Added client-side request retry logic that attempts token refresh and retries once after authentication failures
• Introduced clearLegacyTokens() function to migrate from localStorage-based tokens

🔑 Export-Key Recovery

• Added step-up reauthentication flow allowing users to re-derive export-key by entering current password
• Improved UI messaging distinguishing between "Unlock with current password" and "recover with previous password"

🛠 Improvements

🔄 Token Management

• Namespaced user refresh cookies to __Host-DarkAuth-Refresh for clarity and to avoid admin ambiguity
• Enhanced refresh token handling to prevent race conditions during concurrent refresh attempts
• Ensured refresh token continuity across browser restarts and OAuth flows

📋 Cookie Infrastructure

• Applied secure cookie flags to first-party refresh tokens: Secure, HttpOnly, SameSite=Lax, Path=/
• Implemented session transport using cookie-based authentication with OAuth refresh-assisted renewal

🧪 Tests

✅ API Authentication

• Aligned user authentication tests with cookie-based refresh token flow
• Added test coverage for automatic 401/403 response handling and session renewal

📝 Documentation

📖 Specification Updates

• Updated session authentication specifications with clear cookie naming conventions
• Documented silent renewal behavior and export-key recovery flow in session management specs

Docker

docker pull ghcr.io/puzed/darkauth:v1.4.4