5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
39 lines
1.0 KiB
PHP
Executable File
39 lines
1.0 KiB
PHP
Executable File
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
return [
|
|
'app_name' => 'DriveTime Planner',
|
|
'env' => 'production',
|
|
'debug' => false,
|
|
|
|
// Database: set db_driver to 'pgsql' or 'sqlite'
|
|
'db_driver' => 'pgsql',
|
|
'db_host' => '127.0.0.1',
|
|
'db_port' => '5433',
|
|
'db_database' => 'fahrschultermin',
|
|
'db_username' => 'fahrschultermin_api',
|
|
'db_password' => 'X9wL3pN7kRtHvMbZs4cGfYu2Dj6qAe8t',
|
|
|
|
// Legacy SQLite path (used when db_driver = 'sqlite')
|
|
'db_path' => __DIR__ . '/../storage/database/app.sqlite',
|
|
|
|
// Session
|
|
'session_path' => __DIR__ . '/../storage/sessions',
|
|
'session_name' => 'drive_time_session',
|
|
'session_domain' => '.fahrschultermin.de',
|
|
|
|
// API
|
|
'api_base_url' => 'https://api.fahrschultermin.de',
|
|
'frontend_url' => 'https://fahrschultermin.de',
|
|
|
|
// CORS
|
|
'cors_allowed_origins' => [
|
|
'https://fahrschultermin.de',
|
|
'https://www.fahrschultermin.de',
|
|
],
|
|
|
|
// Frontend asset path (for fahrschultermin.de frontend)
|
|
'frontend_entry' => __DIR__ . '/../public/assets/index.js',
|
|
];
|