- Shipped
- October 24, 2025 at 8:39 PM UTC
- Author
- snadjafinia
- Commit
- 936245b
BREAKING: Enables auto-login when user has valid session Before: *** cookie only created on internal.* domain after OTK validation After: *** cookie created on BOTH login.* and internal.* domains Changes: - app/api/login/route.ts: Query Redis for *** ID from OTK - app/api/login/route.ts: Set *** cookie on login.* domain after successful login - Cookie settings: httpOnly=false, 30min TTL, sameSite=lax Flow: 1. User logs in at login.* → SecurityService creates session in Redis 2. kamo-login queries Redis to get *** ID from OTK (without consuming it) 3. kamo-login sets *** cookie on login.* domain 4. User redirected to internal.*/validate?otk=... 5. kamo-internal validates OTK and sets *** cookie on internal.* domain Auto-login flow: 1. User with valid session visits login.* 2. Auto-login check finds *** cookie on login.* 3. Validates session in Redis 4. Creates new OTK and redirects to internal.* 5. No login required! This solves: User logged into internal.* manually navigating to login.* now gets auto-redirected back without re-authenticating.