5d87e4975c
Problem: Frontend JS bundle used credentials:'same-origin' which dropped cookies on cross-domain requests. Login worked (200) but the subsequent /auth/me check returned 401, leaving the user stuck on the login screen. Fix: - AuthController now sets a dtp_jwt HttpOnly cookie on login/refresh - Cookie uses Domain=.fahrschultermin.de (shared between frontend and api subdomain), Secure, SameSite=Lax, Max-Age=8h - JwtMiddleware reads JWT from Authorization header OR cookie - Added AuthController::me() endpoint (was missing, caused 500) - Logout endpoint clears the cookie - Frontend index.php patches fetch() to use credentials:'include' for all /api/v1/* calls
25 lines
868 B
PHP
Executable File
25 lines
868 B
PHP
Executable File
<?php
|
|
// debug.php - run via CLI on server
|
|
$_SERVER['REQUEST_METHOD'] = 'POST';
|
|
$_SERVER['REQUEST_URI'] = '/api/v1/auth/login';
|
|
$_SERVER['HTTP_HOST'] = 'api.fahrschultermin.de';
|
|
$_SERVER['HTTPS'] = 'on';
|
|
|
|
$config = require __DIR__ . '/config/app.php';
|
|
|
|
try {
|
|
\App\Support\Database::configure($config);
|
|
|
|
$userRepo = new \App\Repositories\UserRepository();
|
|
$user = $userRepo->findByEmail('admin@nordring.test');
|
|
|
|
echo "User found: " . ($user ? 'YES' : 'NO') . "\n";
|
|
if ($user) {
|
|
echo "Hash: " . substr($user['password_hash'], 0, 20) . "...\n";
|
|
echo "Verify: " . (password_verify('secret123', $user['password_hash']) ? 'YES' : 'NO') . "\n";
|
|
}
|
|
} catch (Throwable $e) {
|
|
echo "ERROR: " . $e->getMessage() . "\n";
|
|
echo "File: " . $e->getFile() . ":" . $e->getLine() . "\n";
|
|
echo "Trace: " . $e->getTraceAsString() . "\n";
|
|
} |