Stop persisting auth session token in browser storage

This commit is contained in:
Jage9
2026-02-28 04:09:02 -05:00
parent cf54132c25
commit 4ff070b2db
2 changed files with 9 additions and 8 deletions

View File

@@ -1,5 +1,5 @@
// Maintainer-controlled web client version. // Maintainer-controlled web client version.
// Format: YYYY.MM.DD Rn (example: 2026.02.20 R2) // Format: YYYY.MM.DD Rn (example: 2026.02.20 R2)
window.CHGRID_WEB_VERSION = "2026.02.28 R313"; window.CHGRID_WEB_VERSION = "2026.02.28 R314";
// Optional display timezone for timestamps. Falls back to America/Detroit if unset/invalid. // Optional display timezone for timestamps. Falls back to America/Detroit if unset/invalid.
window.CHGRID_TIME_ZONE = "America/Detroit"; window.CHGRID_TIME_ZONE = "America/Detroit";

View File

@@ -11,7 +11,6 @@ const MIC_INPUT_GAIN_STORAGE_KEY = 'chatGridMicInputGain';
const MASTER_VOLUME_STORAGE_KEY = 'chatGridMasterVolume'; const MASTER_VOLUME_STORAGE_KEY = 'chatGridMasterVolume';
const PEER_LISTEN_GAINS_STORAGE_KEY = 'chatGridPeerListenGains'; const PEER_LISTEN_GAINS_STORAGE_KEY = 'chatGridPeerListenGains';
const NICKNAME_STORAGE_KEY = 'spatialChatNickname'; const NICKNAME_STORAGE_KEY = 'spatialChatNickname';
const AUTH_SESSION_TOKEN_STORAGE_KEY = 'chatGridAuthSessionToken';
const AUTH_USERNAME_STORAGE_KEY = 'chatGridAuthUsername'; const AUTH_USERNAME_STORAGE_KEY = 'chatGridAuthUsername';
type DevicePreference = { type DevicePreference = {
@@ -116,15 +115,17 @@ export class SettingsStore {
} }
loadAuthSessionToken(): string { loadAuthSessionToken(): string {
return localStorage.getItem(AUTH_SESSION_TOKEN_STORAGE_KEY) || ''; // Session tokens are intentionally not persisted in browser storage.
// Remove any legacy stored token and force fresh auth on reload.
localStorage.removeItem('chatGridAuthSessionToken');
return '';
} }
saveAuthSessionToken(token: string): void { saveAuthSessionToken(token: string): void {
if (token) { // Session tokens are intentionally not persisted in browser storage.
localStorage.setItem(AUTH_SESSION_TOKEN_STORAGE_KEY, token); // Keep behavior explicit: always clear any legacy token slot.
return; void token;
} localStorage.removeItem('chatGridAuthSessionToken');
localStorage.removeItem(AUTH_SESSION_TOKEN_STORAGE_KEY);
} }
loadAuthUsername(): string { loadAuthUsername(): string {