lib/session-token

Secure-mode session token, shared by both transports and both dashboards.

The token arrives in the page URL (?token=). The WebSocket handshakes carry it themselves; in secure mode every other /api/ route wants it too, so every caller presents it the same way:

• scripts put Authorization: Bearer <token> on their fetch/XHR calls (sessionAuthHeaders); the server accepts it beside Basic auth too, since a script's header replaces the browser's cached Basic credentials;
• URLs the browser navigates to rather than fetches, such as the file-manager listing the dashboards open in an iframe, carry it as ?token= (withSessionToken); the listing keeps it on its own links;
• a same-site cookie scoped to the API prefix (installSessionCookie) covers anything the browser requests on its own, such as a download link or a listing opened by hand. It is a session cookie, so closing the browser clears it, and the next page load with a token overwrites it. A server outside secure mode ignores all three.

Variables

SESSION_TOKEN_COOKIE

const SESSION_TOKEN_COOKIE: "selkies_token" = 'selkies_token';

Defined in: lib/session-token.js:29

Name of the API-scoped session cookie.

Functions

getSessionToken()

function getSessionToken(): string;

Defined in: lib/session-token.js:36

Reads the session token from the page URL.

Returns

string

The token, or '' when the page has none (legacy mode, or a context without a location).

sessionAuthHeaders()

function sessionAuthHeaders(headers?): any;

Defined in: lib/session-token.js:50

Request headers with the Bearer token added when the page holds one.

Parameters

Returns

any

A plain header object.

withSessionToken()

function withSessionToken(url): string;

Defined in: lib/session-token.js:65

A same-origin URL with the page's token appended as ?token=, for URLs the browser navigates to (an iframe src, a link) rather than fetches.

Parameters

Returns

string

The URL as given without a token, else resolved and tokened.

installSessionCookie()

function installSessionCookie(): void;

Defined in: lib/session-token.js:85

Mirrors the page's token into the API-scoped session cookie.

Called once by each core at load. A page without a token leaves any existing cookie alone, since another tab may still be using it; a cookie write the browser blocks leaves the header and query carriers, which is why this is best-effort.

Returns

void