From 1e53758753befcc7ef874f3da6c5bf7ac044ed5e Mon Sep 17 00:00:00 2001 From: Nick Szaunig Date: Thu, 3 Sep 2026 01:20:51 +0200 Subject: [PATCH] fix: proxy.ts redirete staendig zurueck zu /login, obwohl eingeloggt Der voran gegangene Fix (proxy.ts nach src/ verschoben, damit Next.js sie ueberhaupt erkennt) hat eine zweite, bislang tote Stelle live geschaltet: eine Cookie-Pruefung auf "refreshToken", die zu /login umleitet, wenn das Cookie fehlt - fuer /settings, /apiaries, /colonies, /queens. Dieses Cookie wird vom BACKEND gesetzt (eigene Domain, apicorebackend.* statt apicore.*, Pfad /api/v1/auth) und ist dem Browser zufolge nie Teil einer Anfrage an das Frontend - proxy.ts lief auf der Frontend-Domain und konnte dieses Cookie strukturell nie sehen. Solange die Datei am falschen Ort lag und nie ausgefuehrt wurde, blieb das folgenlos; sobald sie lief, hat sie jeden Aufruf dieser Seiten serverseitig zurueck zu /login geschickt, unabhaengig vom tatsaechlichen Login-Status. Die Cookie-Pruefung komplett entfernt statt repariert: es gibt keinen Weg, ein cross-origin gesetztes Cookie hier sichtbar zu machen, ohne seinen Schutz (Pfad-Scoping) aufzuweichen. Die echte Session lebt ohnehin nur clientseitig (Access-Token im Speicher, Refresh-Cookie nur fuer Backend-Aufrufe) - src/app/(app)/layout.tsx prueft das bereits korrekt und leitet bei Bedarf weiter. proxy.ts setzt jetzt nur noch die Security-Header. Lokal verifiziert: /settings/users ohne jedes Cookie liefert jetzt 200 statt eines Redirects, CSP zeigt weiterhin den korrekten Laufzeit-API_URL. Co-Authored-By: Claude Sonnet 5 --- ApiCore-Frontend/src/proxy.ts | 58 ++++++++++------------------------- 1 file changed, 17 insertions(+), 41 deletions(-) diff --git a/ApiCore-Frontend/src/proxy.ts b/ApiCore-Frontend/src/proxy.ts index c6f4c24..82f13f8 100644 --- a/ApiCore-Frontend/src/proxy.ts +++ b/ApiCore-Frontend/src/proxy.ts @@ -1,24 +1,21 @@ import { NextResponse } from "next/server"; -import type { NextRequest } from "next/server"; -const SESSION_COOKIE = "refreshToken"; - -// Paths that redirect to /login when there's no session - kept identical to -// the set this file already covered before security headers moved in here. -// Broadening this would silently change auth-redirect behaviour for pages -// that currently rely on client-side auth checks instead (dashboard, -// bottling, etc.) and must not now start doing it as a side effect of the -// matcher below being widened for headers. -const AUTH_REDIRECT_PATTERNS = [ - /^\/settings(\/.*)?$/, - /^\/apiaries(\/.*)?$/, - /^\/colonies(\/.*)?$/, - /^\/queens(\/.*)?$/, -]; - -function needsAuthRedirectCheck(pathname: string): boolean { - return AUTH_REDIRECT_PATTERNS.some((pattern) => pattern.test(pathname)); -} +// There used to be a cookie-based redirect-to-/login check here, gated on +// the "refreshToken" cookie. It could never work: that cookie is set by the +// BACKEND's own origin (a different domain, apicorebackend.* vs apicore.*), +// scoped to /api/v1/auth - the browser never sends it on requests to the +// frontend, so this proxy (running on the frontend's origin) can never see +// it. The check always evaluated "no session", harmless while this file +// sat in the wrong directory and never ran at all, but once relocated so +// Next.js actually picked it up, it started force-redirecting every visit +// to /settings, /apiaries, /colonies, /queens straight back to /login, +// regardless of whether the user was genuinely logged in - login state for +// this app is only observable client-side (in-memory access token, +// cross-origin refresh cookie), which is exactly what +// src/app/(app)/layout.tsx already correctly redirects on. Removed rather +// than patched: there is no way to make a cross-origin cookie visible to +// this server without weakening the cookie itself (e.g. dropping its path +// scope), which isn't worth it for a redirect the client already handles. // Deliberately computed here, not in next.config.ts: that file's headers() // is resolved once at build time and frozen into the standalone output, so @@ -64,32 +61,11 @@ function withSecurityHeaders(response: NextResponse): NextResponse { return response; } -export function proxy(request: NextRequest) { - const hasSession = request.cookies.has(SESSION_COOKIE); - const { pathname } = request.nextUrl; - - if (pathname.startsWith("/login")) { - if (hasSession) { - return withSecurityHeaders( - NextResponse.redirect(new URL("/settings/users", request.url)), - ); - } - return withSecurityHeaders(NextResponse.next()); - } - - if (needsAuthRedirectCheck(pathname) && !hasSession) { - return withSecurityHeaders( - NextResponse.redirect(new URL("/login", request.url)), - ); - } - +export function proxy() { return withSecurityHeaders(NextResponse.next()); } export const config = { - // Broadened from the original 5-path list so every page gets the security - // headers (not just the ones that also happen to need the auth-redirect - // check, which is now handled separately above, unchanged in scope). matcher: [ "/((?!_next/static|_next/image|favicon.ico|sw.js|manifest.webmanifest|icon.svg).*)", ],