akanealw/Charon
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

feat: switch WebSocket auth from query params to HttpOnly cookies for security

Browse Source 
Co-authored-by: Wikid82 <176516789+Wikid82@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2025-12-17 12:54:35 +00:00
parent a01bcb8d4a
commit e1474e42aa
3 changed files with 42 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
frontend/src/api/logs.ts
View File

@@ -128,11 +128,8 @@ export const connectLiveLogs = (
if (filters.level) params.append('level', filters.level);
if (filters.source) params.append('source', filters.source);
// Get auth token from localStorage (key: charon_auth_token)
const token = localStorage.getItem('charon_auth_token');
if (token) {
params.append('token', token);
}
// Authentication is handled via HttpOnly cookies sent automatically by the browser
// This prevents tokens from being logged in access logs or exposed to XSS attacks
const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
const wsUrl = `${protocol}//${window.location.host}/api/v1/logs/live?${params.toString()}`;
@@ -196,11 +193,8 @@ export const connectSecurityLogs = (
if (filters.host) params.append('host', filters.host);
if (filters.blocked_only) params.append('blocked_only', 'true');
// Get auth token from localStorage (key: charon_auth_token)
const token = localStorage.getItem('charon_auth_token');
if (token) {
params.append('token', token);
}
// Authentication is handled via HttpOnly cookies sent automatically by the browser
// This prevents tokens from being logged in access logs or exposed to XSS attacks
const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
const wsUrl = `${protocol}//${window.location.host}/api/v1/cerberus/logs/ws?${params.toString()}`;