Add HttpOnly cookie auth for cross-domain SPA login

Browse Source

Problem: Frontend JS bundle used credentials:'same-origin' which
dropped cookies on cross-domain requests. Login worked (200) but
the subsequent /auth/me check returned 401, leaving the user stuck
on the login screen.

Fix:
- AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh
- Cookie uses Domain=.fahrschultermin.de (shared between frontend
  and api subdomain), Secure, SameSite=Lax, Max-Age=8h
- JwtMiddleware reads JWT from Authorization header OR cookie
- Added AuthController::me() endpoint (was missing, caused 500)
- Logout endpoint clears the cookie
- Frontend index.php patches fetch() to use credentials:'include'
  for all /api/v1/* calls

...

This commit is contained in:

Hermes Agent

2026-06-04 20:33:31 +02:00

parent 5f753c15df

commit 5d87e4975c

1040 changed files with 95 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

0

backup/fahrschultermin_20260518_223313/www/api.fahrschultermin.de/public/index.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/AppointmentsController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/AuthController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/BootstrapController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/InstructorsController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/ReferenceDataController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/StudentsController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/TenantsController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Http/Controllers/UsersController.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/AppointmentRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/BaseRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/InstructorRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/ReferenceDataRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/StudentRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/TenantRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Repositories/UserRepository.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Services/CalendarService.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Services/HolidayService.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Services/RequirementService.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Services/SunTimesService.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Support/Auth.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Support/Database.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Support/Request.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Support/Response.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/Support/Router.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/app/bootstrap.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/bin/migrate.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/bin/seed.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/config/app.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/001_initial.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/002_instructors_user_link.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/003_backfill_instructor_user_links.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/004_lesson_type_template_visibility.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/005_tenant_location_sun.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/006_tenant_federal_state.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/007_student_prior_completed_units.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/008_lesson_type_system_key.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/009_requirement_phase_labels.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/010_student_email.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/010_students_contact_flags.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/011_student_needs_glasses.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/012_split_combination_templates.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/013_combo_generic_key_cleanup.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/014_legacy_student_key_aliases_to_lesson_type_keys.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/database/migrations/015_instructor_pre_start_buffer.sql Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/public/.htaccess Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/public/assets/.vite/manifest.json Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/public/assets/assets/main-C54NZrM5.css Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/public/assets/assets/main-F76uNDS1.js Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/public/index.html Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/public/index.php Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/database/app.sqlite Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/database/app.sqlite.bak-20260422203538 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/database/app.sqlite.bak-users-20260422204004 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0006a50819ddb4c83f8927e073726008 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_00309f86663d537153fcb66685d86df7 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_00409744a4c7e3bb92d2eb4076f6f9f1 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_004433bebe95f3233eb3afeacee557d2 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_01276da25030fe7610e51db01928f92e Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_013cba357db97c86d9affd6f490425d2 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_01db5cc5dc2af4df786929887036129e Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_025b3db5cdc9307a49bbc4e7c8569322 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_02ce241714378b298d820865b9f207fa Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0302bb8051aea505d498b8118cf07cbc Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_033690960537713e4b7584067e851174 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0387d0c9c23e92d7c5da1f59219d140a Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_03ab912d95e7096bd5041a815feaaac6 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_03bec560a62e6282f3c00ee39e0b5185 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_03f80785c72e82de6dbb20e633f8e70b Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_04921a0b3787740b88c11ab3b2b4d4dc Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_04ba107751852addceb705f95cb01636 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_04e7eeca7ab45efc4714e55d0e488aab Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_04ec6601cf72642f743fb0ad41d466b8 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0521642416caa2fbc62e3f8298109cf1 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_052b45081be50758c250257b9a65d04a Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_05fa0356f494ca589061fb1f1cda9f38 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_05fc405f00dd93a93a4e02d048ecfdef Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_05fe8c42f2d6ce2eb298f3773fe7aa46 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_06322d63f2b61ed856911309f0491b02 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_068031028f6af11d6206ba4e176e106f Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_06b2450149fb978337c3b300c5177c89 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_06d7f7359a7c55810206e5722284344a Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_076f1f9b3f3607d85628e676aa3deeef Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0781485879098048ec9ec26f838e230b Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0854ff9e45ba1f5477fbbad5e54698f3 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_087a67b3949d5d39a90f231048dbc168 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_09013b1da99e4f816a92e860b645e65b Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0979ad1bce9bd29c7f78266fb0db9496 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_09a34f83873ab7845a54ad0e1f123da2 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0a1062c7493039579c5b1ccf819017cf Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0a3a77bb3b296f6ef7c2c58f223522dc Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0a457d212ce74a302f1245eaadd68550 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0a8407b10f0705fb94abc083ef7629a1 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0a918e1bf4f81d888710bb6eabccf5b7 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0b02235f6c9d7a8fdd13403950def66a Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0b4c3e7eeb7915687615efbcb7ad351a Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0b689f1efcd64909309b788ce0aa77a8 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0b7a6dd656b413dfa91158a8f36533fe Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0bee18c4dceb5b1916bfb6d16f940237 Normal file → Executable file

0

backup/fahrschultermin_20260518_223313/www/fahrschultermin.de/storage/sessions/sess_0c6b2d92ad51dc235c8a326a6f15bbde Normal file → Executable file

Some files were not shown because too many files have changed in this diff Show More