feat(frontend): enforce auth through httpOnly cookies

[0ubbe]

Changes 🏗️

Implemented httpOnly cookies 🍪 for secure session management 💆🏽

• 🙏🏽 Moved all API requests to server-side execution for maximum XSS protection

  • All authentication now happens server-side with httpOnly cookies (no JWT tokens exposed to client)
  • Created proxyApiRequest() and proxyFileUpload() server actions to handle all communication with API
  • Updated BackendAPI._request() to always use proxy approach for consistent security

• 🚧 Exception: WebSocket authentication requires client-side token exposure

  • Added getWebSocketToken() server action to securely provide tokens only for WebSocket connections
  • Maintains secure architecture while we keep the real-time features

• 🧹 Abstracted implementation details into reusable helper functions

  • Reduced proxy actions from 157 lines to 48 lines (70% reduction)
  • Added flexible content-type support ( JSON, form-urlencoded, custom )
  • Enhanced error handling for graceful logout scenarios

• 📙 Renamed /reset_password page to /reset-password

  • couldn't resist sorry... snake case URLs get me

Checklist 📋

For code changes:

• I have clearly listed my changes in the PR description
• I have made a test plan
• I have tested my changes according to the test plan:
  • Verify all API requests work through server-side proxy
  • Confirm httpOnly cookies prevent client-side JWT access
  • Test WebSocket connections work with server-provided tokens
  • Verify logout scenarios don't throw authentication errors
  • Check file uploads work securely through proxy
  • Validate zero breaking changes for existing BackendAPI calls

[netlify]

✅ Deploy Preview for auto-gpt-docs-dev canceled.

Name	Link
🔨 Latest commit	a57deb9
🔍 Latest deploy log	https://app.netlify.com/projects/auto-gpt-docs-dev/deploys/685555fd5a69940008071c11

[netlify]

✅ Deploy Preview for auto-gpt-docs canceled.

Name	Link
🔨 Latest commit	a57deb9
🔍 Latest deploy log	https://app.netlify.com/projects/auto-gpt-docs/deploys/685555fd4ebd4500082a9ecd

[deepsource-io]

Here's the code health analysis summary for commits 91ea322..a57deb9. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
JavaScript	✅ Success	❗ 14 occurences introduced 🎯 13 occurences resolved	View Check ↗
Python	✅ Success		View Check ↗

---

💡 If you’re a repository administrator, you can configure the quality gates from the settings.