jtricerolph
f63dd67668
Kiosk sessions were minted under the same cookie name ('hnf_session') as a
real staff session, on the same origin -- the browser can end up holding two
same-named cookies with different scope with no guarantee which one it sends,
so a valid staff login could get shadowed by a stale kiosk cookie (hit
2026-08-26 testing kiosk login on a desktop browser, then unable to log into
the normal manage pages).
Fix: kiosk sessions now live in their own cookie, 'hvac_kiosk_session',
completely independent of the real staff session. hvac's requireAuth checks
hnf_session first, falls back to hvac_kiosk_session. Also dropped the
now-unneeded DOMAIN cross-subdomain cookie scoping -- this cookie is only
ever read by hvac's own backend, so a plain host-scoped cookie is simplest.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| lib | ||
| routes | ||
| auth.js | ||
| db.js | ||
| index.js | ||
| ip-check.js | ||