5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
45 lines
902 B
PHP
Executable File
45 lines
902 B
PHP
Executable File
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Support\Database;
|
|
use App\Support\Request;
|
|
use App\Support\Router;
|
|
|
|
const BASE_PATH = __DIR__ . '/..';
|
|
|
|
spl_autoload_register(static function (string $class): void {
|
|
$prefix = 'App\\';
|
|
|
|
if (!str_starts_with($class, $prefix)) {
|
|
return;
|
|
}
|
|
|
|
$relativeClass = substr($class, strlen($prefix));
|
|
$path = __DIR__ . '/' . str_replace('\\', '/', $relativeClass) . '.php';
|
|
|
|
if (is_file($path)) {
|
|
require_once $path;
|
|
}
|
|
});
|
|
|
|
$config = require BASE_PATH . '/config/app.php';
|
|
|
|
date_default_timezone_set('UTC');
|
|
session_name($config['session_name']);
|
|
|
|
$sessionPath = $config['session_path'];
|
|
if (!is_dir($sessionPath)) {
|
|
mkdir($sessionPath, 0775, true);
|
|
}
|
|
|
|
session_save_path($sessionPath);
|
|
session_start();
|
|
|
|
Database::configure($config['db_path']);
|
|
|
|
return [
|
|
'config' => $config,
|
|
'router' => new Router(new Request()),
|
|
];
|