July 19, 2026 — Netlify HttpOnly cookie bridge (July 18 tech debt)
Path: netlify/ + _pwa-build/js/ · July 19, 2026 (site v1.0.28) · SW cache v64
Why
- July 18 “Remember this device” used JS-writable cookies (not HttpOnly). XSS could read tokens; full session JSON hit cookie size limits.
- Follow-up: Netlify edge bridge with
HttpOnly; Secure; SameSite=Strict.
Edge endpoints
POST /api/auth/set-session — set phvac-sb-access + phvac-sb-refresh (+ expires / remember). Payload: access + refresh tokens (not a single blob).GET /api/auth/session — probe only; never returns the token.POST / DELETE /api/auth/logout — clear all session cookies.- Shared helpers:
netlify/edge-functions/lib/session-cookies.js, netlify/lib/session-cookies.mjs.
Client
session-cookie-bridge.js — syncHttpOnlySession / clearHttpOnlySession (best-effort, in-flight coalesce).- PWA
supabase-client.js + root supabase.js: SIGNED_IN, INITIAL_SESSION, TOKEN_REFRESHED, USER_UPDATED → sync; SIGNED_OUT → clear.
- Members logout awaits clear before redirect.
- Client dual-write in
auth-storage.js still present (gradual migration); bridge is the durable HttpOnly path.
Netlify Functions
save-diagnostic-log, assign-membership, create-checkout-session: Bearer or phvac-sb-access cookie, then verifySupabaseJwt.- Supabase license edge (
claim-free-license / recover-license) stays Bearer-only (cross-origin; cookies not sent).
Geo-lock
- Removed
geo-lock edge function and registration. Beta continues without Canada-only edge block.
- Home / PWA copy: “Free beta access” (no geo-locked wording).
Version & deploy
- Site version 1.0.28; service worker
phvac-app-v64 (precache bridge module + this log).
- Static + Netlify edge deploy via git push; no Supabase function redeploy required for this change set.