pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-21 22:32:22 +03:00
Code Issues Packages Projects Releases Wiki Activity

docs(auth): dashboard session = verified JWT + authenticated claim

Browse Source 
Refs #13298
This commit is contained in:
diegosouzapw
2026-09-11 19:00:02 -03:00
parent 5d29ac1371
commit 584b7db02f
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/fixes/13298-dashboard-session-authenticated-claim.md Normal file
View File

@@ -0,0 +1 @@
- **fix(auth):** a dashboard session now requires the `authenticated: true` claim that login, OIDC and the session refresh already emit — a JWT merely signed with `JWT_SECRET` (for example the Cursor CLI passthrough token, which any API-key holder can obtain) no longer verifies as the `auth_token` cookie on any route, the WebSocket handshake or the live server; existing sessions keep working ([#13298](https://github.com/diegosouzapw/OmniRoute/issues/13298))

8
docs/architecture/AUTHZ_GUIDE.md
View File

@@ -35,6 +35,14 @@ For dashboard pages and admin operations.
Cookie: auth_token=<JWT signed with JWT_SECRET>
```
A cookie is a session only when the JWT verifies **and** carries `authenticated: true`
(`src/shared/utils/dashboardSessionToken.ts` → `verifyDashboardSessionToken`). Every
consumer of the cookie (route guard, authz pipeline refresh, WebSocket handshake, live
server, `/api/settings/require-login`, `/api/auth/status`) goes through that helper.
Other JWTs signed with `JWT_SECRET` exist — the Cursor CLI passthrough mints
`iss "omniroute" / aud "cursor-cli"` tokens for key holders — and are never sessions
(#13298).
Verified by `isDashboardSessionAuthenticated()` in `src/shared/utils/apiAuth.ts`. The pipeline auto-refreshes the JWT when it has fewer than 7 days left in its 30-day lifetime.
Some management routes accept **either** mode: cookie OR `Bearer <key>` when the API key has the `manage` (or `admin`) scope. This is what enables the "configurable via API calls" workflow added in v3.8.