- Ya
- 24 Septemba 2026, 01:31 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 46191c4
The 15 places a hook opens a STOMP/SockJS connection to MediaService (media.<domain>/ws) or EmailService (via the /email-ws rewrite) put the raw 128-char *** session id on the query string (?***=<token>) — Traefik's access log kept it in cleartext for as long as it keeps one. That id is also no longer readable from page script at all (app/lib/sessionHandle seals it), so the value was about to disappear from these hooks regardless. A hook now mints a one-time key instead: **************** POSTs /api/generate-otk?purpose=ws (a 64-hex-char key, 30 s TTL) and hands it to the stompjs Client's `beforeConnect`, which stompjs awaits before every connect AND every reconnect — so a hook that reconnects an hour later still mints a fresh key rather than replaying a stale one. Every webSocketFactory reads the latest key at the moment it builds the SockJS URL (`?otk=<key>`); a failed mint still attempts the connect with no key, which the backend refuses, and stompjs retries after reconnectDelay. The existing "is there a session at all" gates are untouched — several hooks still read sessionStorage directly for that truthiness check, which is fine and unrelated to the value going out on the wire. **************** now also fails any client file (tests exempt — they name it to forbid it) that still builds a URL with `***=`, pointing at mintWsKey. It found exactly these 15 sites on origin/main; none remain, and restoring one old hook turns it red. MediaService (b0e08ac2) and EmailService (279723a4) already accept `?otk=` — checked first and not consumed, an unknown key refused outright, the legacy `?***=` still accepted for older clients — and both run those commits. Tests: wsSessionAuth.test.ts, **************** (vitest now collects app/hooks/**/__tests__); types/@stomp__stompjs.d.ts declares beforeConnect.